Beware of the LegionLoader malware being distributed via the ClickFix method

Reported 11 Sep 2026 by otx · Severity: medium

LegionLoader malware is being distributed through ClickFix tactics using fake Cloudflare CAPTCHA pages. Two primary distribution methods have been identified: one exploits Korea's Newlywed Hope Town Namu Wiki page with malicious URLs, while the other uses spear phishing emails ta