2026-08-05Microsoft Threat Intelligence
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
Read the original ↗: From open lures to cloaked gates: How a macOS ClickFix campaign learned to hideRetrieved 2026-08-07
Supports
Publisher
Microsoft Threat Intelligence
www.microsoft.com/en-us/security/blog ↗Vendor research
- Reports structured
- 4
- Campaign records
- 15
- Indicators credited
- 203
- First report
- 2025-08-21
- Latest report
- 2026-08-05
Original research
4 reports published by Microsoft Threat Intelligence are the basis for 15 published campaign records and for 203 indicators in the record. Every one of those pages names them and links their original above the fold.
- The links to their articles are ordinary dofollow links. No nofollow, no ugc, no redirect hop. We are a derivative work built on their research and the link is the payment.
- None of their prose is reproduced. Summaries on this site are composed from extracted fields in our own words; quotations run under 25 words and are attributed inline.
- Every indicator credited to a report of theirs was matched, character for character, against the archived copy of that report before it could be stored. That is a database constraint, not a review step.
These pages summarise and structure that research; they are not a substitute for the originals.
Reports we have structured
4 reports
- 2026-05-06Microsoft Threat Intelligence
ClickFix campaign uses fake macOS utilities lures to deliver infostealers
Read the original ↗: ClickFix campaign uses fake macOS utilities lures to deliver infostealersRetrieved 2026-08-07
- 2026-02-05Microsoft Threat Intelligence
New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan
Read the original ↗: New Clickfix variant ‘CrashFix’ deploying Python Remote Access TrojanRetrieved 2026-08-29
- 2025-08-21Microsoft Threat Intelligence
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Read the original ↗: Think before you Click(Fix): Analyzing the ClickFix social engineering techniqueRetrieved 2026-08-07
Records built on their reporting
15 records
ModeloRAT via a fake CrashFix popup
Status as last assessed: ActiveID 7d88b9bfPublished 2026-08-29First seen —1 report from Microsoft Threat IntelligenceAMOS with a hidden boot backdoor
Status as last assessed: ActiveID ea3b83eaPublished 2026-08-07First seen 2026-01-311 report from Microsoft Threat IntelligenceTelegram fallback C2 on macOS
Status as last assessed: ActiveID 5e799560Published 2026-08-07First seen 2026-04-011 report from Microsoft Threat IntelligenceSHub Stealer via macOS Terminal
Status as last assessed: ActiveID 6fc04ed4Published 2026-08-07First seen 2026-02-011 report from Microsoft Threat IntelligencemacOS disk-cleanup lure sites
Status as last assessed: ActiveID bb8d3f37Published 2026-08-07First seen 2026-01-311 report from Microsoft Threat IntelligenceAMOS behind a fingerprint gate
Status as last assessed: ActiveID ee88ee33Published 2026-08-07First seen —1 report from Microsoft Threat IntelligenceCloudflare Turnstile iframe lure
Status as last assessed: ActiveID 55c5b43fPublished 2026-08-07First seen 2025-05-221 report from Microsoft Threat IntelligenceAMOS via a fake Spectrum page
Status as last assessed: ActiveID 1f22b447Published 2026-08-07First seen 2025-05-301 report from Microsoft Threat IntelligenceOBSCURE#BAT via a Discord lure
Status as last assessed: ActiveID 092c751dPublished 2026-08-07First seen 2025-02-241 report from Microsoft Threat IntelligenceLatrodectus from Storm-0249
Status as last assessed: ActiveID 0216315ePublished 2026-08-07First seen 2025-05-141 report from Microsoft Threat IntelligenceLumma Stealer via film piracy sites
Status as last assessed: ActiveID e01a09c6Published 2026-08-07First seen 2025-04-021 report from Microsoft Threat IntelligenceScreenConnect via a fake SSA site
Status as last assessed: ActiveID 64b61ec1Published 2026-08-07First seen 2025-06-021 report from Microsoft Threat IntelligenceMintsLoader from Storm-0426
Status as last assessed: ActiveID daec320fPublished 2026-08-07First seen 2025-03-261 report from Microsoft Threat IntelligenceDarkGate from Storm-1607 mail
Status as last assessed: DormantID 1e32ad6ePublished 2026-08-07First seen 2024-03-011 report from Microsoft Threat IntelligenceLampion via a Portuguese tax lure
Status as last assessed: ActiveID 90794874Published 2026-08-07First seen 2025-05-061 report from Microsoft Threat Intelligence
For Microsoft Threat Intelligence
If anything on this page or on the records above misrepresents your work, attributes something to you that you did not publish, or you would rather not be listed at all, email corrections@clickfixreport.com. We correct within 5 working days, no questions asked, and removal is a request rather than a negotiation. Corrections are logged publicly with what changed and when.