Birdeye-spoofing ClickFix domains

Summary

Recorded Future's Insikt Group published this on 25 March 2026 as one of five ClickFix clusters, and had reported on the group before. Active since May 2024, the cluster runs its lures on dozens of domains built around the word bird, spoofing Birdeye, an AI marketing company. A visitor to a compromised site is shown a Cloudflare-style check asking for a command in the Windows Run dialog. The command downloads a text payload from a host Insikt links to earlier Lumma Stealer and RedLine delivery, and the browser is then sent to the real Birdeye site so nothing seems amiss. The page script assembles the clipboard command from seven obfuscated lines with the developer's comments left in, one of them in Cyrillic about getting past Cloudflare's static analysis. Insikt names NetSupport RAT as the cluster's payload.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

39 of 41

Checks recorded

39

Checks since publication

39

Never checked

2

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 2 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 15 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

41 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.