A new ClickFix campaign targets the hospitality sector in Europe, using fake Windows BSOD screens to trick users into executing malware. Attackers send phishing emails impersonating Booking.com, leading victims to a convincing fake website that prompts them to run malicious commands. Once executed, the malware grants remote access and can spread within the network.

A new variant of the ClickFix attack uses a malicious Chrome extension that pretends to be an ad blocker. It tricks users into executing harmful commands that install the ModeloRAT malware, primarily targeting corporate environments.

Microsoft identified an updated ClickFix campaign that disrupts users' browsers and tricks them into executing harmful commands. This variant uses social engineering and exploits native Windows utilities to deliver a Python RAT payload while evading traditional detection methods.

The article discusses the evolution of malware, highlighting a new variant known as ClickFix that emerged from the notorious MonsterRat. It examines the techniques used by this malware to exploit vulnerabilities and the implications for cybersecurity.

LastPass has alerted macOS users about a malicious campaign using fake password managers and other software, which deliver the Atomic info-stealing malware through deceptive GitHub repositories. The campaign employs search engine optimization tactics to promote these fraudulent applications, urging users to execute potentially harmful commands that install malware on their systems. Users are advised to only download software from official sources to avoid such threats.

iClicker's website was compromised in a ClickFix attack that used a fake CAPTCHA to trick users into executing a PowerShell script that potentially installed malware on their devices. The attack, targeting college students and instructors, aimed to steal sensitive data, but the malware's specific nature varied based on the visitor type. Users who interacted with the fake CAPTCHA between April 12 and April 16, 2025, are advised to change their passwords and run security checks on their devices.

A new campaign utilizing ClickFix attacks is now targeting both Windows and Linux systems, with the threat group APT36 adapting social engineering tactics to trick users into executing malicious commands. The Linux variant involves redirecting victims to a CAPTCHA page that prompts them to run a benign command, potentially paving the way for future attacks. Users are advised to avoid executing unknown commands to mitigate the risk of malware infections.