2025-04-16Proofpoint
Around the World in 90 Days: State-Sponsored Actors Try ClickFix
Read the original ↗: Around the World in 90 Days: State-Sponsored Actors Try ClickFixRetrieved 2026-08-07
Publisher
Proofpoint
www.proofpoint.com/us/blog/threat-insight ↗Vendor research
- Reports structured
- 3
- Campaign records
- 10
- Indicators credited
- 112
- First report
- 2024-06-17
- Latest report
- 2025-04-16
Original research
3 reports published by Proofpoint are the basis for 10 published campaign records and for 112 indicators in the record. Every one of those pages names them and links their original above the fold.
- The links to their articles are ordinary dofollow links. No nofollow, no ugc, no redirect hop. We are a derivative work built on their research and the link is the payment.
- None of their prose is reproduced. Summaries on this site are composed from extracted fields in our own words; quotations run under 25 words and are attributed inline.
- Every indicator credited to a report of theirs was matched, character for character, against the archived copy of that report before it could be stored. That is a database constraint, not a review step.
These pages summarise and structure that research; they are not a substitute for the originals.
Reports we have structured
3 reports
- 2024-11-14Proofpoint
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
Read the original ↗: Security Brief: ClickFix Social Engineering Technique Floods Threat LandscapeRetrieved 2026-08-07
- 2024-06-17Proofpoint
From Clipboard to Compromise: A PowerShell Self-Pwn
Read the original ↗: From Clipboard to Compromise: A PowerShell Self-PwnRetrieved 2026-08-29
Supports
Records built on their reporting
10 records
UNK_RemoteRogue using Empire
Status as last assessed: DormantID d48c97cdPublished 2026-08-07First seen 2024-12-091 report from ProofpointMuddyWater deploying Level RMM
Status as last assessed: DormantID 14797046Published 2026-08-07First seen 2024-11-131 report from ProofpointKimsuky deploying QuasarRAT
Status as last assessed: ActiveID 71f11de9Published 2026-08-07First seen 2025-01-011 report from ProofpointUAC-0050 overlap in Ukrainian mail
Status as last assessed: ActiveID 468c485bPublished 2026-08-07First seen 2024-10-311 report from ProofpointXWorm via ChatGPT malvertising
Status as last assessed: ActiveID fcb64726Published 2026-08-07First seen 2024-10-191 report from ProofpointBrute Ratel C4, then Latrodectus
Status as last assessed: ActiveID 64eb116fPublished 2026-08-07First seen 2024-09-201 report from ProofpointNetSupport RAT via link-free mail
Status as last assessed: ActiveID 6e742ac5Published 2026-08-07First seen 2024-09-051 report from ProofpointRicardo marketplace lure in German
Status as last assessed: ActiveID bd2a1de1Published 2026-08-07First seen 2024-09-251 report from ProofpointLumma Stealer via GitHub issue mail
Status as last assessed: ActiveID c28a85bbPublished 2026-08-07First seen 2024-09-181 report from ProofpointDarkGate from Storm-1607 mail
Status as last assessed: DormantID 1e32ad6ePublished 2026-08-07First seen 2024-03-011 report from Proofpoint
For Proofpoint
If anything on this page or on the records above misrepresents your work, attributes something to you that you did not publish, or you would rather not be listed at all, email corrections@clickfixreport.com. We correct within 5 working days, no questions asked, and removal is a request rather than a negotiation. Corrections are logged publicly with what changed and when.