Campaign record
DeerStealer via an IUAM kit page
DeerStealer delivered by a fake CAPTCHA page built with the IUAM ClickFix Generator
- Status as last assessed
- Active
- First seen
- Unrecorded
- Last seen
- Unrecorded
- Indicators
- 24
- Sources
- 1
- Targets
- Windows
- Fake CAPTCHA verification
- DeerStealer
- IUAM ClickFix Generator
Original research
- Unit 42, Palo Alto Networks2025-10-08Vendor research
The ClickFix Factory: First Exposure of IUAM ClickFix Generator
This page summarises and structures that research; it is not a substitute for the original.
Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.
Summary
A Windows-only deployment of the kit. The operator left platform detection switched off, so visitors on any other system were offered nothing at all. Ticking the checkbox on the counterfeit human-verification widget ran background JavaScript that loaded a PowerShell one-liner into the clipboard, while a panel told the reader to open the Run dialog, paste and press Enter. Doing so fetched a batch file into the temporary folder and ran it immediately; the batch file then pulled down an MSI installer carrying the DeerStealer information stealer. Unit 42 lists eight sample hashes and fifteen host names for this strand, with no role given for the hosts and no dates. The article separately warns that some pages of this sort sat on ordinary websites the operator had broken into, so a share of those hosts may belong to victims.
Execution mechanisms
The only execution mechanism any published account describes for this campaign is Windows Run dialog (T1204.004), which 23 of the 44 published campaigns in this corpus also record (52%).
Indicators
24 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.
“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.
Not on this record
This record does not yet carry a second publisher's account, any overlap with another campaign in this corpus or our own re-checks of these indicators. Each appears on this page as its own section once it exists; none of it is inferred.
Cite as
ClickFixReport, “DeerStealer via an IUAM kit page”, campaign ID d9e3bd3c, retrieved 2026-08-07, snapshot fb0eed7.
https://clickfixreport.com/campaigns/d9e3bd3c/deerstealer-clickfix
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.