Analyzing a Full ClickFix Attack Chain - Part 1

Reported 23 Apr 2026 by otx · Severity: medium

A sophisticated ClickFix campaign was detected in mid-March 2026, beginning with a malicious webpage impersonating Booking.com's visual identity with a fake CAPTCHA. The attack leverages social engineering to trick victims into executing a PowerShell command that downloads and ru