IUAM ClickFix Generator

Summary

Unit 42 found the builder rather than only its output. An open HTTP server on TCP port 3000 ran an Express web application, styled with Tailwind, whose single job was producing counterfeit browser-verification pages. An operator fills in a form: page title, spoofed domain, the wording of the widget, footer and instruction panel, and above all the string that gets placed silently into a visitor's clipboard. Further options cover obfuscation, automatic clipboard-copy injection, a prompt telling phone users to move to a computer, and detection of the visitor's platform so Windows sees one instruction and macOS another. The host was reachable from mid-July 2025 into early October. Unit 42 treats the find as evidence of commoditisation: rival kits competing to package the technique for buyers who lack the skill to write one.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Clipboard injection (T1204.004), which 15 of the 44 published campaigns in this corpus also record (34%).

Indicators

1 indicator, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.