Published 2026-08-29Status as last assessed: Active
StopAndProtect ClickFix operation
Reported by Check Point Research
Targets Windows
- Indicators
- 39
- First seen
- 2026-04-24
Public reference index
The public record of ClickFix campaigns
A free, permanent, fully attributed index of the ClickFix and fake-CAPTCHA campaigns that have been publicly reported, and of the indicators that came with them.
Did you just paste something?What to do now, in order. Takes about fifteen minutes.ClickFix is a paste attack: a page persuades you to copy a line of text and run it yourself, in the Windows Run box or the macOS Terminal, usually behind a check claiming to verify you are human. Nothing is exploited — the reader does the work.
Defanged input works too — example[.]com and hxxps://example[.]com both resolve.
Where to go from here
I just pasted something
What to do now, in the order that matters. Nothing asks you to run a command, and stopping early still leaves you most of the protection.
Read the guidesI am investigating something
Every domain, address and file hash we hold has a page recording which reports named it and on which dates. Where we have since re-checked a host, the page carries what we found and every date we looked, including the checks that found nothing. Values are shown defanged and are never links. The corpus is downloadable and free to redistribute.
Browse indicators
Straight there: I pasted on Windows · I pasted on macOS · Is this CAPTCHA a virus?
The record, in numbers
- Campaigns
- 44
- Indicators
- 1,359
- Domains
- 713
Counts are of published records only. Drafts, withdrawn entries and values we could not match against an archived source are excluded.
Latest campaigns
All campaigns →- Published 2026-08-29Status as last assessed: Active
SHub and MacSync via GitHub lures
Reported by Datadog Security Labs
Targets macOS
- Indicators
- 26
- First seen
- —
- Published 2026-08-29Status as last assessed: Active
ModeloRAT via a fake CrashFix popup
Reported by Microsoft Threat Intelligence
Targets Windows
- Indicators
- 20
- First seen
- —
What this is
A derivative work, and deliberately so. Other people do the research; we structure it, date it, and keep it findable.
Nothing is here unattributed
Every record names the publisher who reported it and links their original above the fold, dofollow, with no redirect in between. We never reproduce a vendor’s prose. Editorial policy.
An indicator has to be in the source
A value is stored only if its exact string appears in the archived copy of the report we credit. That is a database constraint, not a review step. Methodology.
You can take the whole thing
CSV, JSON and plain host lists, CC BY 4.0, no key and no account. Export URLs are versioned, so anything you parse keeps its shape. Data and exports.