ClickFix

ChatGPT

2026-09-29 13:17:37

Hackers use ChatGPT custom GPTs to run ClickFix social engineering attacks

Techub, citing Crypto Briefing, reported that hackers are using ChatGPT’s custom GPT feature to carry out a social engineering campaign known as ClickFix. The attackers create GPTs that appear to be legitimate services, then use them to steer users toward malicious links or harmful file downloads. The case points to a security gap around how AI platform listings are presented and how related advertising or verification processes are handled. It also highlights a broader issue for AI platforms: tools designed for customization and discovery can be abused when bad actors package malicious prompts or links inside products that look trustworthy. The report did not disclose further technical details, but it framed the incident as a sign that platform safeguards and ad verification checks need to be strengthened.

250

WordPress

2026-08-20 16:33:38

Nearly 2,000 Hacked WordPress Sites Used as Malware and Ransomware Infrastructure

Nearly 2,000 compromised WordPress sites were used as part of a broader cybercriminal operation that distributed malware, stole files, monitored victims, and deployed ransomware, according to a report from Check Point Research published Tuesday. The firm said it first identified the StopAndProtect ransomware family in mid-May and later linked it to a larger toolkit-driven campaign rather than a single malware strain. Researchers said the operation targeted Windows users through fake CAPTCHA prompts on hacked websites, tricking victims into running a PowerShell command that installed malware capable of stealing credentials, harvesting cryptocurrency wallet seed phrases, spreading through networks and USB drives, locking screens, and dropping ransomware. Check Point said operational security failures by the attackers exposed internal files, infection logs, screenshots from victim machines, and source code used to manage compromised websites at scale. By July 24, the campaign had affected more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India. The researchers also collected more than 31,000 screenshots and over 700 archives containing stolen documents, passwords, and crypto wallet files.

1210

Microsoft Thr

2026-08-07 16:36:59

Microsoft says hackers are using BNB Chain contracts and fake CAPTCHAs to deliver malware

Microsoft Threat Intelligence said a malware campaign is using compromised websites, fake CAPTCHA prompts, and BNB Chain smart contracts to deliver malicious commands to victims. In the activity described by Microsoft, JavaScript planted on hacked sites contacts a BNB Chain gateway and pulls instructions from a smart contract previously tied to the ClearFake campaign. The setup uses a technique known as EtherHiding, which stores malicious instructions on-chain, making them harder to remove because only the wallet controlling the contract can change its contents. Victims are shown fake verification prompts that tell them to open the Windows Run dialog, paste clipboard content, and press Enter. Microsoft said this method, known as ClickFix, relies on users executing the malware themselves, while a related variation called TerminalFix sends users to Windows Terminal or PowerShell. The company said these approaches have become a high-volume initial access technique affecting thousands of enterprise and consumer devices globally each day. Microsoft also warned that attackers are abusing legitimate Windows tools such as PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. It advised organizations to restrict unnecessary command-line tools, enable PowerShell logging, and apply application controls. The company added that users should never paste commands from CAPTCHA pages, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command Prompt.

550

ClickFix

2026-08-07 02:52:57

Microsoft Threat Intelligence Flags ClickFix and EtherHiding Malware Campaign

Microsoft Threat Intelligence has flagged a cluster of compromised websites that are spreading malware through two abuse techniques: ClickFix and EtherHiding. The campaign reportedly targets thousands of enterprise and consumer devices every day. Attackers inject Base64-encoded JavaScript into affected pages, which then reaches out to BNB Smart Chain RPC gateways and pulls the next-stage instructions stored on a smart contract. Because only the deployer wallet can modify that contract, conventional takedown methods are difficult to apply. To get the infection going, victims are shown a fake CAPTCHA and tricked into opening the Run dialog, pasting clipboard contents, and executing attacker-supplied commands. Microsoft flagged the abuse of system tools such as conhost, cmd, PowerShell and mshta, along with command obfuscation. If the chain completes, credential exposure, persistence, lateral movement and ransomware attacks become possible. Microsoft recommends that organizations enable layered Defender protection, restrict command-line tools and enable PowerShell script logging, while users should not paste unrecognized commands into the Run box or a terminal.

1970

Microsoft

2026-08-07 03:03:14

Microsoft says ClickFix attacks hide commands in blockchain smart contracts

Microsoft Threat Intelligence said it has identified a set of compromised websites using ClickFix bait and an EtherHiding technique associated with the ClearFake campaign. Attackers inject Base64-encoded JavaScript and use BNB Smart Chain RPC gateways to query smart contracts for the next-stage commands. Because the instructions are stored on-chain, they are harder to take down with traditional methods. Microsoft said the flow presents users with a fake CAPTCHA and then tries to trick them into opening the Windows Run dialog to paste and execute malicious commands. The company said the technique has been used to deliver information stealers such as Lumma Stealer and remote access trojans, affecting thousands of devices worldwide each day. Microsoft advised users not to paste commands from CAPTCHA prompts and to enable the relevant Defender protections.

1810

Microsoft

2026-08-07 02:56:06

Microsoft: Hackers Hide Malicious Code in BNB Chain Smart Contracts, Thousands of Devices Hit

Microsoft's threat intelligence team has disclosed a new attack campaign that abuses BNB Chain smart contracts to hide malicious code. Compromised websites use ClickFix and TerminalFix lures, combined with EtherHiding, to retrieve next-stage instructions from contracts through BNB Smart Chain RPC gateways. Because the malicious payload lives on-chain and only the wallet that deployed the contract can modify it, traditional takedown or blocking methods are hard to apply. Attackers fake CAPTCHA pages and trick users into opening Windows Run, Terminal, or PowerShell, then pasting and executing commands. The campaign leans heavily on built-in system tools such as conhost, PowerShell, mshta, rundll32, curl, WMI, and WebDAV for obfuscation and living-off-the-land techniques. Microsoft says ClickFix and TerminalFix have become high-frequency initial access vectors, affecting thousands of business and personal devices daily. Multiple groups are using them to distribute Lumma Stealer, Xworm, AsyncRAT, and MintsLoader, which could lead to credential theft, lateral movement, and ransomware. Microsoft advises users never to paste or run commands in Windows Run, Terminal, PowerShell, or Command Prompt based on CAPTCHA prompts, webpage errors, emails, or ads.

1830