TF-1989474
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload iranmesgar.ir
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-10-25 20:27:15 UTC. Reporter: varysz. Tags: ClickFix.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
iranmesgar.ir
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
iranmesgar.ir- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-10-25 20:27:15 UTC. Reporter: varysz. Tags: ClickFix.
Remediations (10)
-
web:ctiwatch.com
IClickFix is a malicious JavaScript framework deployed on compromised WordPress sites to deliver further malware using the ClickFix social engineering tactic and fake Cloudflare Turnstile CAPTCHA challenge.
-
web:protectyourwp.com
The IClickFix framework serves as a widespread and persistent initial access vector, leveraging the ClickFix social engineering tactic for malware distribution.
-
web:securityonline.info
IClickFix malware hijacks 3,800+ WordPress sites with fake Cloudflare CAPTCHAs. This watering hole attack tricks users into running malicious PowerShell.
-
web:socprime.com
They captured the exact PowerShell execution pattern used to retrieve the final payload and recovered the dropped NetSupport RAT components along with associated C2 infrastructure indicators. Mitigation Monitor web content for the ic-tracker-js injection and block known malicious domains , redirectors, and short-link services used in the chain.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with js. iclickfix . You can also get this data through the ThreatFox API. Database Entry
-
web:threatfox.abuse.ch
IClickFix IOC: iranmesgar.ir ( domain ) ThreatFox IOC Database You are viewing the ThreatFox database entry for domain iranmesgar.ir . Database Entry
-
web:www.csoonline.com
The WordPress ClickFix campaign delivers three separate infostealer payloads — two of them previously unknown — and uses domain infrastructure that appears to have been set up since July 2025.
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.hhs.gov
Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads ( a practice known as EtherHiding ...
-
web:www.stormshield.com
Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.