TF-1981159 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: IClickFix. Confidence: 90. First seen: 2026-10-23 05:32:07 UTC. Reporter: LocalReporter. Tags: c2, ClickFix, fastflux.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: IClickFix. Confidence: 90. First seen: 2026-10-23 01:15:23 UTC. Reporter: LocalReporter. Tags: c2, ClickFix, fastflux.

• IClickFix malware — IOCs & CVEs | isMalicious
  web:ismalicious.com

  9,126 indicators of compromise attributed to the IClickFix malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  2026-10-23 02:24 UTC
• IClickFix (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  IClickFix is a malicious JavaScript framework deployed on compromised WordPress sites to deliver further malware using the ClickFix social engineering tactic and fake Cloudflare Turnstile CAPTCHA challenge.

  2026-10-23 02:24 UTC
• Inside ClickFix: How Fake Prompts Took Over the Web
  web:netlas.io

  Execution typically results in persistence being established, outbound command-and-control traffic, and full compromise of the user context. All of this is achieved through a single pasted command, executed by the victim themselves.

  2026-10-23 02:24 UTC
• ICLICKFIX - Omar Rao | Cybersecurity
  web:omarrao.substack.com

  IClickFix is a malicious JavaScript framework found injected into thousands of compromised WordPress websites. It leverages the ClickFix social engineering tactic to redirect visitors and ultimately deliver malware to victims' computers.

  2026-10-23 02:24 UTC
• Meet IClickFix: a widespread WordPress-targeting framework using the ...
  web:protectyourwp.com

  The ClickFix command is also copied to the user's clipboard. Figure 5. ClickFix lure impersonating Cloudflare Turnstile used by the IClickFix framework This widespread social engineering tactic, known as ClickFix, is designed to convince users to run a malicious command in their Windows console, thereby compromising their system.

  2026-10-23 02:24 UTC
• The "IClickFix" Trap: 3,800+ WordPress Sites Poisoned by Fake CAPTCHAs
  web:securityonline.info

  IClickFix malware hijacks 3,800+ WordPress sites with fake Cloudflare CAPTCHAs. This watering hole attack tricks users into running malicious PowerShell.

  2026-10-23 02:24 UTC
• IClickFix: WordPress ClickFix Chain Drops NetSupport RAT
  web:socprime.com

  The report profiles IClickFix , a malicious JavaScript framework that compromises WordPress sites and presents a spoofed Cloudflare Turnstile-style CAPTCHA. The lure coerces visitors into executing a PowerShell command that downloads and installs NetSupport RAT.

  2026-10-23 02:24 UTC
• ClickFix Attacks: How They Work and How CrowdStrike Stops Them
  web:www.crowdstrike.com

  ClickFix attacks trick users into executing malicious commands themselves. Learn how CrowdStrike Falcon Seraphic Enterprise Browser and the Falcon platform help stop attacks across the browser, endpoint, identity, and SOC.

  2026-10-23 02:24 UTC
• PDF 202410291500_ClickFix Attacks Sector Alert_TLPCLEAR - HHS.gov
  web:www.hhs.gov

  Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads (a practice known as EtherHiding ...

  2026-10-23 02:24 UTC
• Think before you Click(Fix): Analyzing the ClickFix social engineering ...
  web:www.microsoft.com

  The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  2026-10-23 02:24 UTC

Only Available for Registered Users. Sign in to view.