The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

Reported 20 May 2026 by otx · Severity: medium

The ClickFix campaign has evolved from basic disk-based infections to sophisticated, obfuscated attacks using fake CAPTCHA pages that trick victims into executing malicious PowerShell commands. Initial variants used cleartext commands downloading batch scripts to deploy DeerSteal