Endpoint hardening best practices reduce SMB attack surface by closing common gaps like exposed RDP, RMM abuse, and ClickFix social engineering. Exposed RDP, RMM abuse via phishing, and ClickFix attacks are primary endpoint intrusion paths for SMBs. Practical hardening controls—restricting local admin, locking down the Run prompt, and standardizing remote access tools—disrupt these vectors. Continuous posture management outperforms one-time compliance checklists.
ClickFix
50 posts
What Good Endpoint Hardening Looks Like SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz SloppyRAT is a new RAT delivered via ClickFix lures, using EtherHiding and blockchain-based C2 to support ransomware operations. SloppyRAT is a Windows RAT delivered through a multi-stage ClickFix chain involving finger.exe, IronPython, and CastleLoader. It features 47 built-in PowerShell-like commands, encrypted code blocks, indirect syscalls, and EtherHiding for resilient C2.
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 A ClickFix social engineering campaign abuses Google Sheets as C2 to inject web-skimming JavaScript into browsers, replacing crypto deposit addresses with attacker wallets. Attackers distribute fake vulnerability reports via Telegram and forums, tricking users into pasting malicious JavaScript into Chrome or Tampermonkey. The script fetches obfuscated payloads from Google Sheets via the Visualization API, then hooks the browser fetch API to replace crypto deposit addresses and hijack clipboards.
Node.js: Old Technique Makes a Comeback Attackers are reviving the abuse of the Node.js runtime to execute malicious JavaScript payloads and evade signature-based detection. In multiple intrusions since February 2026, threat actors including initial access broker Woodgnat have used Node.js implants for persistence via registry Run keys and command-and-control via Ethereum blockchain smart contracts (EtherHiding). The technique has been observed alongside tools like ModeloRAT, C2Looper, and Backdoor.Mistic in attacks targeting government, technology, and financial sectors.
TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog The TerminalFix campaign is a ClickFix variant that uses compromised websites displaying fake Cloudflare CAPTCHA overlays to trick users into pasting malicious PowerShell commands into Windows Terminal. The attack chain progresses through DLL sideloading via a legitimate signed binary (LockScreenContentServer.exe loading dui70.dll), steganographic payload extraction from PNG images, dual persistence via registry Run keys and scheduled tasks, extensive Active Directory reconnaissance, and deployment of a custom Python-based reverse tunnel implant communicating over TLS WebSocket to gitnow[.]dev:443. The reverse tunnel provides the attacker with SOCKS5-style TCP proxy access through the compromised host, enabling lateral movement and potential follow-on activity such as privilege escalation, data exfiltration, and ransomware deployment.
A ClickFix cluster: Observed activity from recent ClickFix campaigns A cluster of three ClickFix campaigns observed between June and July 2026 used compromised WordPress sites to deliver social engineering lures that copied malicious commands to victim clipboards. The campaigns deployed payloads via MSI packages, NodeJS, and Python runtimes, all leveraging DLL sideloading with legitimate Windows binaries and hiding artifacts in ProgramData. C2 domains were resolved through dead drop encodings stored in Digital Point forum user profiles. The activity overlaps with the Lorem Ipsum malware family and shares discovery TTPs with the Supper backdoor attributed to Vanilla Tempest.
Beyond the Login Field: The Evolved Phishing Tradecraft Your Users Aren't Ready For Adversaries have evolved phishing tradecraft to bypass MFA and traditional security awareness training by abusing legitimate system tools and cloud authentication flows. Techniques include ClickFix (terminal execution via fake CAPTCHA), Browser-in-the-Browser (HTML-rendered fake windows), OAuth consent phishing, device code flow abuse, and fake video conference overlays. These methods exploit user trust in legitimate infrastructure and routine troubleshooting habits to deploy malware or hijack authentication tokens.
Infostealers highlight malware-as-a-service trend ReversingLabs identified three active infostealer malware-as-a-service families: AuraStealer, ACRStealer/Amatera, and RemusStealer, with 1,110 unique samples observed between June and August 2026. RemusStealer distinguishes itself through Etherhiding, using Ethereum smart contracts for C2 domain resolution. AuraStealer adopted virtualization-based obfuscation, increasing its file size from 500-700KB to 10MB. All three families target browser credentials and crypto wallets, distributed via ClickFix, ClearFake, SEO poisoning, and malvertising.
Understanding Browser Trust Abuse: Exploiting Enterprise’s Most Trusted Interface Threat actors are shifting from exploiting browser software vulnerabilities to abusing user trust in familiar browser workflows. Four prominent techniques—fake software updates, Browser-in-the-Browser (BitB), ClickFix, and Device Code Phishing—rely on social engineering to trick users into installing malware or surrendering credentials. These attacks bypass traditional security controls by leveraging legitimate browser interfaces and authentication processes.
What Good Identity Hardening Looks Like Attackers are shifting from network perimeter breaches to identity compromise, leveraging stolen credentials and session tokens to access consolidated SSO environments. MFA alone is insufficient; gaps like overprivileged accounts, unmonitored session tokens, and MFA exceptions create exploitable paths. The article describes ClickFix social engineering and a real-world BEC case to illustrate the impact of identity security gaps.
How a Google Search for Claude Led to MacSync A malvertising campaign targeting macOS users uses Google sponsored search results to direct victims to a fake Claude installation guide on claude.ai. The guide uses the ClickFix technique, instructing users to paste a curl command into Terminal that downloads the MacSync stealer and RAT. MacSync features a six-stage kill chain that exfiltrates browser data, keychain secrets, and cryptocurrency wallets, and establishes persistence via a Mach-O RAT connecting to a hardcoded IP over WebSocket.
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect The StopAndProtect operation is a multi-component campaign combining ransomware and data theft. It uses a ClickFix social engineering technique to deliver .NET-based loaders, which deploy ransomware, an SMB/USB worm, a lockscreen, a credential stealer, and a chat utility. The actors abuse thousands of compromised WordPress sites as infrastructure for hosting malware, C2 communication, and storing exfiltrated victim data.
C2Looper Backdoor Uses GitHub for C2 | ThreatLabz Zscaler ThreatLabz identified a new Rust-based backdoor called C2Looper in July 2026, likely tied to ransomware operations and delivered via ClickFix infection chains. C2Looper supports backdoor commands including remote shell execution, reconnaissance, and second-stage payload deployment. A version 2 variant introduces GitHub-based C2 communication, shellcode injection via winspool.drv, and additional reconnaissance commands, indicating active development by its authors.
Ransomware Victims Research | ThreatLabz Zscaler ThreatLabz identified 351 victims across 334 organizations in a single ransomware campaign over a one-month period. The campaign targets manager-level employees in finance, sales, operations, HR, and marketing roles, leveraging their business access rather than administrative privileges. Initial access is achieved through spam email followed by Microsoft Teams impersonation and ClickFix-style attacks that trick users into executing malicious commands via the Windows Run prompt.
ClickFix campaign abuses Deno runtime for infostealer delivery The ClickFix campaign abuses the Deno JavaScript runtime as a delivery mechanism for infostealer malware. The article was published by Sophos Counter Threat Unit Research Team but the full content was not provided for detailed analysis.
CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain An investigation traced a loader chain beginning with a ClickFix lure through a legitimately signed IBM SPSS IDE binary used for DLL sideloading, four decoy DLLs, and EnumTimeFormatsEx callback abuse for shellcode execution. The final payload is CNCMachineRMS, a 1.14 MB x64 remote administration implant with no static imports, stack-built strings, a custom binary container format for config and C2, and a custom scripting language. The implant provides an interactive shell, file manager, screen capture, local account backdoor, seven persistence mechanisms, and twenty commands for staging additional payloads. C2 communication uses DNS over HTTPS to bypass internal DNS monitoring and beacons every 600 seconds to notepadreleased.com or 85.158.110.78 over TCP/443.
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide Microsoft Threat Intelligence tracked a macOS ClickFix campaign distributing AMOS and MacSync infostealers through 250+ algorithmically named domains. The campaign evolved from openly embedding malicious Terminal commands in HTML to deploying a server-side browser-fingerprinting gate (TDS) that only serves the ClickFix lure to visitors presenting a genuine macOS browser fingerprint, significantly reducing visibility for automated scanners and researchers. The infection chain uses social engineering to trick users into running curl-piped-to-shell commands that download and execute AMOS, which exfiltrates credentials, browser data, and cryptocurrency wallets.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft Microsoft Threat Intelligence identifies Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread captive portal traffic manipulation attacks since May 2026 targeting travelers at hospitality venues worldwide. The campaign delivers CornFlake, a Go-based Windows RAT with comprehensive surveillance and credential theft capabilities, and ChocoShell, a PowerShell-based infostealer that bypasses AMSI, employs multiple UAC bypass techniques, and extracts browser credentials via Chrome DevTools Protocol to circumvent Chrome App-Bound Encryption. The operation also integrates device code phishing against Microsoft Entra ID, leveraging AI-augmented social engineering and ClickFix techniques to maximize victim compliance.
Ransomware is the Scoreboard This piece is a strategic/opinion analysis arguing that ransomware success stems from defenders' reliance on static vulnerability lists rather than modeling the dynamic attack-path graph (identity, configuration, credential relationships) that adversaries actually traverse. It uses Interlock's ClickFix-based initial access (fake CAPTCHA tricking users into executing malicious commands via the Run dialog) as a case study of a CVE-free attack path invisible to traditional vulnerability management, and advocates for graph-based CTEM augmented with continuous threat intelligence and AI agents for real-time attack path recomputation.
LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses LevelBlue's Q2 2026 TTP Briefing highlights that identity-based attacks—compromised credentials, OAuth tokens, API keys, and machine identities—are outpacing traditional perimeter and MFA defenses, with BEC (45% of incidents) achieving 100% MFA bypass and cloud/supply chain intrusions rising sharply via abused third-party integrations (e.g., the Klue/Salesforce compromise). Phishing remains the top initial access vector (65%), edge/VPN appliance CVEs continue to be heavily exploited for credentialless access, and overall dwell time is shrinking as attackers compress the intrusion path from initial access to impact.
TAG-195 Upgrades MaaS Ecosystem with Modular Tools Insikt Group documents four new TAG-195 (Golden Chickens) malware families — TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator — representing an architectural shift from monolithic implants toward a controller-and-plugin model that loads capability modules on demand from C2. All variants share consistent evasion techniques (filename execution gating, OCX/regsvr32.exe execution, WebSocket JSON C2, and identical Run key persistence), and the ecosystem now includes a Chrome App-Bound Encryption bypass helper and live Chrome DevTools Protocol session hijacking, closing previously identified capability gaps in the group's tooling.
ACR Stealer: Two observed intrusion chains amid increased threat activity Microsoft Defender Experts identified two prevalent ClickFix-based intrusion chains delivering ACR Stealer, a MaaS information stealer rebranded from Amatera Stealer. Campaign 1 leverages rundll32-driven WebDAV DLL loading, obfuscated PowerShell, Python loaders, scheduled-task persistence, and Fiber-API in-memory shellcode execution, with a subset using blockchain RPC endpoints (EtherHiding) as dead-drop C2 resolvers. Campaign 2 achieves near-fully fileless execution via MSHTA/COM-launched PowerShell that retrieves a payload hidden in JPEG steganography and executes it reflectively in memory, with both chains ultimately harvesting browser credentials, DPAPI secrets, and sensitive documents for exfiltration.
The tale of ClickFix: 5 takeaways from RL’s new threat report ClickFix is a social engineering technique that uses fake CAPTCHA pages to trick users into pasting malicious commands into Run dialogs or terminals, executing payloads in memory via LOLBins without triggering traditional AV or EDR signatures. The threat has commoditized through MaaS subscriptions ($250–$1,800), expanded its payload catalog beyond infostealers to include RATs, loaders, and rootkits, and is actively evolving with variants like CrashFix, FileFix, PromptFix, and ConsentFix. ReversingLabs released an open-source multi-condition YARA rule that detects ClickFix lures by correlating fake verification characteristics, PowerShell payload indicators, and clipboard manipulation before payload execution.
ClickFix doesn't attack your knowledge. It attacks your trust. ClickFix is a mature Malware-as-a-Service attack methodology that uses fake verification prompts to silently poison the user's clipboard with malicious commands, which are then pasted into Windows Run or macOS Terminal. The execution chain relies entirely on living-off-the-land binaries (PowerShell, mshta.exe, curl, rundll32.exe), making it invisible to traditional EDR and AV tooling. A specific watering hole attack on a university site delivered zuhe.dll, a Go-based RAT, using blockchain-based C2 via Ethereum smart contracts to evade infrastructure takedowns.
ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites A large-scale ClickFix campaign compromises hundreds of WordPress websites to deliver a macOS infostealer via fake Cloudflare CAPTCHA overlays. The campaign uses a Polygon blockchain smart contract to store the C2 URL, making it resistant to DNS takedowns. Victims are tricked into pasting a Terminal command that downloads an in-memory payload via curl, which uses osascript to harvest Keychain data, browser credentials, SSH keys, and screenshots before exfiltrating them in chunks to an attacker-controlled server.
ClaudeFix: Shared Claude Chats Meet ClickFix | Zscaler A MacSync Stealer campaign abuses Anthropic's Claude shared chat platform to host ClickFix-style malicious instructions, using Google malvertising to lure macOS users searching for Claude. Victims are tricked into running a Base64-obfuscated curl command that pipes a zsh script to execution, which in turn downloads and pipes a second stage to osascript. The stealer collects keychain data, browser credentials, cryptocurrency wallets, cloud keys, and user files, exfiltrating them in 10MB chunks via HTTP PUT before deleting all traces.
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains TELEPUZ is a rapidly evolving modular MaaS malware delivered via ClickFix social engineering and VIDAR second-stage downloader chains. The 64-bit Windows DLL payload uses indirect syscalls, NTDLL unhooking, AMSI/ETW patching, and custom RC4 encryption for defense evasion, while establishing persistence as a Windows service and communicating over WebSockets with fallback C2 resolution via Telegram, Steam, DNS records, and Polygon blockchain smart contracts. The malware supports 36 commands including process hollowing, keylogging, credential theft, browser cookie extraction, and a WebInjector module that abuses Chrome DevTools Protocol to manipulate financial web forms in real-time.
OkoBot: new sophisticated malware framework targets cryptocurrency users Kaspersky identified OkoBot, a sophisticated multi-stage malware framework delivered via the TookPS PowerShell downloader and orchestrated over an attacker-controlled SSH tunnel, targeting cryptocurrency users. The framework comprises over 20 interconnected payloads that perform UAC bypass, RDP hijacking, browser-extension based credential theft (Rilide), hardware-wallet seed-phrase phishing (SeedHunter), keylogging, and screen/video capture (OkoSpyware), all coordinated through a plugin dispatcher communicating over HTTP/HTTPS C2 channels. The campaign has been active since at least March 2025, continues to evolve its tooling, and shows indicators (geoblocking, Russian code comments, use of Rilide) consistent with Russian-speaking cybercriminal operators.
June 2026 Infostealer Trend Report ASEC's June 2026 report details continued high-volume distribution of infostealers (Remus, ACRStealer, LummaC2, Vidar) via SEO-poisoned crack/keygen sites and cloud storage platforms, with DLL side-loading accounting for roughly 15.5% of infections. A notable macOS-focused development uses Polygon blockchain smart contracts for dynamic C2 resolution combined with ClickFix social engineering and .plist LaunchAgent persistence, while email vectors continue delivering AgentTesla and DarkCloud via SMTP exfiltration.
Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor A multi-stage attack campaign uses malicious LNK files delivered via booking-themed phishing emails to deploy a Node.js-based backdoor. The LNK files use bigint arithmetic obfuscation to reconstruct C2 URLs, download a PowerShell payload that deploys a legitimate node.exe binary, and execute an AES-128-CBC encrypted JavaScript backdoor. The backdoor retrieves its C2 address from the TON blockchain using the EtherHiding technique, employs a custom bytecode VM interpreter for defense evasion, and supports downloading and executing additional payloads including PE files, PowerShell, and JavaScript.
ESET Threat Report H1 2026 ESET's H1 2026 Threat Report highlights attackers adapting established techniques to new platforms rather than inventing entirely new methods. Key trends include the emergence of PromptSpy (first Android malware using generative AI in its execution flow), the rapid expansion of malicious AI skills, doubling of ClickFix social engineering detections, record-level QR code phishing (quishing), and continued proliferation of EDR killers alongside declining ransom payment rates.
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit REF6045 is an operator-assisted Mexican banking fraud operation that uses ClickFix fake CAPTCHA pages to deliver the SCMBANKER PowerShell toolkit. Once installed, the toolkit monitors for banking sessions, captures screenshots, deploys vishing overlays, hijacks clipboard data to swap CLABE and card numbers, redirects browsers to phishing pages, and silently installs Remote Utilities as a persistent RAT. The operation's infrastructure suffered significant OPSEC failures including open directories, a leaked web-root archive, and an unauthenticated configuration editor.
6th July – Threat Intelligence Report This weekly threat intelligence bulletin covers multiple active ransomware campaigns, four critical vulnerabilities under active exploitation, and emerging AI-driven threats. Notable items include actively exploited RCE flaws in Oracle E-Business Suite and Progress Kemp LoadMaster, a Citrix NetScaler memory disclosure flaw exploited within 24 hours of disclosure, a North Korean supply-chain campaign (PolinRider) deploying 108 malicious packages, and a proof-of-concept browser-native ransomware generated by an LLM abusing Chrome's File System Access API.
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker Backdoor.Mistic is a new stealthy backdoor deployed in cybercrime intrusions since April 2026, using DLL sideloading via legitimate MpExtMs.exe and masquerading as EndpointDlp.dll. It executes payloads in memory with a self-deleting kill switch, enabling long-term covert access. Mistic is likely linked to Woodgnat (aka KongTuke), an initial access broker whose ModeloRAT toolkit has been used in attacks delivering Qilin ransomware, connecting this backdoor to the broader ransomware ecosystem.
Sayonara, SocGholish: Operation Endgame Disrupts Major Cybercrime Operation Operation Endgame, a coordinated law enforcement action by Netherlands, Canada, US, and Germany, disrupted TA569's SocGholish web inject infrastructure by taking down over 100 servers and remediating 14,971 compromised websites. TA569 compromises legitimate websites—often WordPress installations—to inject obfuscated JavaScript that presents fake browser update pages to visitors, ultimately delivering GhoLoader malware which can lead to ransomware deployments. The attack chain leverages traffic direction systems (TA2726's Keitaro TDS and ParrotTDS) for victim filtering and uses advanced client-side blob URL construction to evade sandbox detection and network-based download tracing.
The Hacker’s 2026 Playbook from the Dark Web The article details two evolving social engineering techniques: ClickFix, which tricks users into pasting and executing attacker-supplied PowerShell commands via fake prompts, and ConsentFix, which abuses Microsoft 365 OAuth consent flows by manipulating users into dragging a localhost callback link into the browser to capture session tokens. A complete ConsentFix playbook with working code was publicly shared on a Russian cybercrime forum, enabling widespread adoption. Both techniques bypass traditional security controls by exploiting user muscle memory and legitimate platform infrastructure.
SmartApeSG Supply Chain Attack Targets Okendo | ThreatLabz ThreatLabz identified a supply chain attack where the threat actor SmartApeSG compromised the widely used Okendo Reviews widget to inject malicious JavaScript. The loader employs environment checks, XOR deobfuscation, and staged execution to deliver ClickFix-style social engineering lures, ultimately aiming to deploy RATs and information stealers on desktop endpoints.
AI Generated ClickFix Attack Delivers SmartRAT | ThreatLabz ThreatLabz identified a ClickFix campaign utilizing AI-generated typosquatting domains to impersonate Brazilian banks and deliver a PowerShell-based banking RAT dubbed SmartRAT. The malware establishes persistence via scheduled tasks or Windows services, communicates over a custom TCP protocol on port 51888, and features advanced capabilities including keylogging, fake banking overlays, and QR code interception for financial fraud.
Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign A sophisticated malvertising campaign abused Google Ads to deliver ClickFix social engineering attacks disguised as popular AI developer tools and Mac utilities. The threat actors initially leveraged GitLab Pages before pivoting to weaponize claude.ai's shared chat feature, tricking macOS users into executing terminal commands that deploy the MacSync infostealer.
What Is the BabaDeda Loader? Analysis of a New ClickFix Malware Campaign Morphisec researchers identified a significantly evolved version of the BabaDeda loader targeting the education and financial sectors. The campaign leverages ClickFix social engineering to trick users into executing PowerShell commands, leading to a complex, multi-stage infection chain involving DLL sideloading, in-memory execution, and external payload storage to deliver DanaBot and SectopRAT.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework ErrTraffic is a Malware-as-a-Service framework that compromises WordPress sites and uses malvertising to deliver ClickFix social engineering lures. It leverages EtherHiding via Polygon smart contracts to dynamically resolve C2 infrastructure and distribute infostealers, RATs, and loaders.
Device code phishing bypasses password stealing An active Microsoft 365 phishing campaign is abusing the OAuth 2.0 Device Authorization Grant flow to achieve account takeover without stealing passwords. The attack utilizes ClickFix-style landing pages with Unicode obfuscation and tricks victims into authorizing an attacker-controlled device via legitimate Microsoft authentication portals, coordinating the flow via a 4-second beaconing mechanism.
Technical Analysis of MLTBackdoor | ThreatLabz ThreatLabz has identified MLTBackdoor, a highly obfuscated post-exploitation framework delivered via ClickFix social engineering lures. The malware utilizes Mixed Boolean-Arithmetic (MBA), Control Flow Flattening (CFF), and indirect system calls to evade detection, while maintaining persistence and control through a custom encrypted protocol, a Domain Generation Algorithm (DGA), and a Beacon Object File (BOF) loader.
From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT A recent phishing campaign impersonates Amazon security alerts to deliver a custom remote access trojan (RAT) dubbed HarborWatch Agent. The attack leverages the ClickFix technique, using a fake CAPTCHA page to socially engineer victims into manually executing a malicious PowerShell command via the Windows Run dialog. Once executed, the script downloads the RAT, which collects system information and communicates with a C2 infrastructure managed via a panel called Harbor Sentinel.
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem Check Point Research uncovered a large-scale malware distribution ecosystem that uses search engine optimization and impersonated open-source project sites to drive traffic to a sophisticated Traffic Distribution System (TDS). The TDS employs click hijacking and strict gating to selectively deliver malware, including the SessionGate loader, RemusStealer, and AnimateClipper, while actively evading automated analysis through one-time key releases and file inflation.
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet Threat actors behind the ClearFake campaign are leveraging EtherHiding to host malicious JavaScript payloads within BNB Smart Chain testnet smart contracts, bypassing traditional URL-based blocking. The attack chain begins with a compromised watering hole site and uses a ClickFix social engineering overlay to trick Windows and macOS users into executing malicious commands. This leads to the deployment of SectopRAT and ACRStealer via WebDAV DLL loading and DLL sideloading, enabling extensive credential and browser session theft.
Major Cyber Attacks in May 2026: Fake Invitations, Agent Tesla, BlobPhish, and More In May 2026, ANY.RUN observed a surge in sophisticated phishing and malware campaigns utilizing fileless execution, browser-based credential theft, and legitimate workflow abuse. Key threats included Agent Tesla credential harvesting, ClickFix fileless malware, BlobPhish in-memory page generation, and phishing-to-RMM chains bypassing traditional MFA via real-time OTP interception.
Top 5 Phishing-Driven Social Engineering Attacks on Companies in 2026 Modern social engineering attacks have evolved to closely mimic legitimate business workflows, utilizing techniques like ClickFix, OAuth device code abuse, and in-browser blob phishing. These tactics bypass traditional security controls and create "gray-zone" alerts that require deep behavioral analysis to determine the true scope of compromise, such as credential theft, token abuse, or RMM deployment.
Why AMOS matters: The macOS malware stealing data at scale Sophos MDR investigated a macOS infostealer infection attributed to an AMOS (Atomic macOS) variant. The attack leverages ClickFix social engineering to trick users into running a malicious Terminal command, which initiates a multi-stage infection chain. The malware captures the user's system password via a spoofed prompt, evades analysis by checking for virtualized environments, and exfiltrates sensitive data like Keychain and browser credentials before establishing persistence via a LaunchDaemon.
Exploits and vulnerabilities in Q1 2026 In Q1 2026, vulnerability registrations continued to rise, heavily influenced by AI-assisted discovery tools. Threat actors and APT groups actively exploited a mix of legacy and newly discovered vulnerabilities across Windows, Linux, and Microsoft Office, frequently utilizing C2 frameworks like Metasploit and Sliver to bypass authentication and gain initial access.
