TF-2011937
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload theliverfoundation.org
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-11-02 22:29:10 UTC. Reporter: varysz. Tags: ClickFix.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
theliverfoundation.org
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
theliverfoundation.org- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-11-02 22:29:10 UTC. Reporter: varysz. Tags: ClickFix.
Remediations (10)
-
web:socprime.com
Summary A new ClickFix campaign has been identified using fake Cloudflare verification pages to target both macOS and Windows users. The campaign utilizes malicious domains to host deceptive content and distribute malware . The specific malware payload could not be retrieved during this investigation due to server errors and resolution failures. Investigation The investigator analyzed the ...
-
web:socprime.com
They captured the exact PowerShell execution pattern used to retrieve the final payload and recovered the dropped NetSupport RAT components along with associated C2 infrastructure indicators. Mitigation Monitor web content for the ic-tracker-js injection and block known malicious domains , redirectors, and short-link services used in the chain.
-
web:thehackernews.com
The payload is gated on machine identity The third finding is the one that should change how teams interpret their tooling. In the dropper recovered from the live host, a hardware and account fingerprint machine GUID, volume serial, computer name , BIOS manufacturer, system model, GPU and username is base64-encoded directly into the download path.
-
web:www.crowdstrike.com
ClickFix attacks trick users into executing malicious commands themselves. Learn how CrowdStrike Falcon Seraphic Enterprise Browser and the Falcon platform help stop attacks across the browser, endpoint, identity, and SOC.
-
web:www.csoonline.com
The WordPress ClickFix campaign delivers three separate infostealer payloads — two of them previously unknown — and uses domain infrastructure that appears to have been set up since July 2025.
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.hhs.gov
Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads ( a practice known as EtherHiding ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.sekoia.com
Uncover IClickFix : a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.
-
web:www.sentinelone.com
Threat actors are compromising websites and embedding fraudulent CAPTCHA images, leading to the delivery of malware and malicious code. This attack methodology is widely referred to as " ClickFix ". Victims are socially-engineered into solving a malicious challenge, leading to the execution of PowerShell code followed by additional payloads . Final payloads observed include an array of ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.