ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery

Reported 04 Jun 2026 by otx · Severity: medium

A multi-stage phishing campaign emerged in early May 2026, impersonating LinkedIn and Indeed through typosquatted domains to deliver malicious payloads. The attack chain begins with fake CAPTCHA pages distributed via Google Ads, leveraging the legacy Finger protocol and native Wi