TF-2011986
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload abogadoaccidentescercademi.com
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-11-02 22:36:48 UTC. Last seen: 2026-11-02 23:02:39 UTC. Reporter: varysz. Tags: ClickFix.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
abogadoaccidentescercademi.com
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
abogadoaccidentescercademi.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-11-02 22:36:48 UTC. Last seen: 2026-11-02 23:02:39 UTC. Reporter: varysz. Tags: ClickFix.
Remediations (10)
-
web:ismalicious.com
9,126 indicators of compromise attributed to the IClickFix malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:securityarsenal.com
A domain referenced in 1,700+ code repos and docs is now pushing ClickFix malware to Windows users. Hunt, block, and audit before developers copy-paste their way into compromise.
-
web:socprime.com
Summary A new ClickFix campaign has been identified using fake Cloudflare verification pages to target both macOS and Windows users. The campaign utilizes malicious domains to host deceptive content and distribute malware . The specific malware payload could not be retrieved during this investigation due to server errors and resolution failures. Investigation The investigator analyzed the ...
-
web:socprime.com
They captured the exact PowerShell execution pattern used to retrieve the final payload and recovered the dropped NetSupport RAT components along with associated C2 infrastructure indicators. Mitigation Monitor web content for the ic-tracker-js injection and block known malicious domains , redirectors, and short-link services used in the chain.
-
web:thehackernews.com
The payload is gated on machine identity The third finding is the one that should change how teams interpret their tooling. In the dropper recovered from the live host, a hardware and account fingerprint machine GUID, volume serial, computer name , BIOS manufacturer, system model, GPU and username is base64-encoded directly into the download path.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with js. iclickfix . You can also get this data through the ThreatFox API. Database Entry
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.hhs.gov
Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads ( a practice known as EtherHiding ...
-
web:www.sekoia.com
Uncover IClickFix : a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.
-
web:www.stormshield.com
Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.