Published 2026-10-11Status as last assessed: Active
DOUBLECUP ClickFix loader service
Reported by SOCRadar
Targets Windows, macOS
- Indicators
- 43
- First seen
- —
Campaign index
Every ClickFix campaign on record
One operation as the people who documented it described it, reconciled across vendors into a single record.
61 published records · page 1 of 4
Published campaign records
- Published 2026-10-11Status as last assessed: Active
Deno-runtime ClickFix on WordPress
Reported by Sophos
Targets Windows
- Indicators
- 4
- First seen
- 2026-06-03
- Published 2026-10-11Status as last assessed: Active
WebDAV rundll32 ordinal ClickFix
Reported by CyberProof
Targets Windows
- Indicators
- 7
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
ErrTraffic BW Panel via Cloudflare Zaraz
Reported by Derp
Targets Windows, macOS
- Indicators
- 4
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
WallStealer and a miner via ClickFix
Reported by CtrlAltIntel
Targets Windows
- Indicators
- 23
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
WordPress fake reCAPTCHA macOS stealer
Reported by Report URI
Targets macOS
- Indicators
- 102
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
Psychedelic Stealer via fake Cloudflare
Reported by Arctic Wolf
Targets Windows
- Indicators
- 10
- First seen
- 2026-09-12
- Published 2026-10-11Status as last assessed: Active
EtherHiding ClickFix on Polygon
Reported by GuidePoint Security
Targets Windows
- Indicators
- 31
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
PavinLoader in ClickFix campaigns
Reported by Malwarebytes
Targets Windows
- Indicators
- 28
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
WordlistLoader delivering Amatera
Reported by Gen Digital
Targets Windows
- Indicators
- 46
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
macOS storage-cleaner ClickFix
Reported by Recorded Future
Targets macOS
- Indicators
- 8
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
Birdeye-spoofing ClickFix domains
Reported by Recorded Future
Targets Windows
- Indicators
- 41
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
Booking.com ClickFix to NetSupport RAT
Reported by Recorded Future
Targets Windows
- Indicators
- 26
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
QuickBooks-themed ClickFix to NetSupport
Reported by Recorded Future
Targets Windows
- Indicators
- 40
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
PasteSwitch ClickFix operation
Reported by Cato Networks, Hudson Rock
Targets macOS, Windows
- Indicators
- 236
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
Amatera via ClearFake and WebDAV
Reported by rmceoin, Cisco Talos
Targets Windows, macOS
- Indicators
- 22
- First seen
- —
- Published 2026-10-11Status as last assessed: Active
TerminalFix reverse-tunnel intrusion
Reported by Microsoft Threat Intelligence
Targets Windows
- Indicators
- 15
- First seen
- —
- Published 2026-08-29Status as last assessed: Active
StopAndProtect ClickFix operation
Reported by Check Point Research
Targets Windows
- Indicators
- 39
- First seen
- 2026-04-24
- Published 2026-08-29Status as last assessed: Active
SHub and MacSync via GitHub lures
Reported by Datadog Security Labs
Targets macOS
- Indicators
- 26
- First seen
- —
- Published 2026-08-29Status as last assessed: Active
ModeloRAT via a fake CrashFix popup
Reported by Microsoft Threat Intelligence
Targets Windows
- Indicators
- 20
- First seen
- —