[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz4oFphHhdTQOnyRiq_Zrj93j3FoatTSGGObKChI5iqk":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f47ecb66-1433-450c-bc4d-5471e2141f0a","17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360","17-000-urls-reveal-how-clickfix-turns-trusted-websites-into-malware-traps-report-540800","ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read","A new report from CTM360 details ClickFix, an increasingly common initial access technique that bypasses traditional security measures by tricking users into pasting malicious commands into trusted system interfaces. The attack chain leverages compromised websites and blockchain technology for infrastructure resilience, making traditional domain blocking ineffective. This method has seen a significant rise, with Microsoft reporting it as the leading cause of enterprise network intrusions.","ClickFix uses trusted websites to trick users into pasting malicious commands, bypassing traditional defenses.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002F17000-urls-reveal-how-clickfix-turns.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiOah63YM6pjk2RAIcCXy-NSbO_uPPCSp4DsR-9-jeGLCRZCd9E1QSd0_b4c6xc5wFp_ncqCH3LPtBR_C1auF3Fid-DNSCtQh9eEArgNe0syhvA4I9EdDU454uAqieiAGyyI-dXW5AsA5X4zsbhTpHKjXfIbgM35i4MOC7Jcbk5SiILRU9_BgcV2H-_BxI\u002Fs1600\u002Fctm360.jpg","2026-09-24T09:14:21+00:00","2026-09-24T12:00:09.697661+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Cloudflare","product",{"name":21,"type":19},"WordPress",{"name":23,"type":19},"Telegram",{"name":25,"type":19},"Steam",{"name":27,"type":19},"Microsoft Defender",{"name":29,"type":30},"blockchain","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[50],{"type":51,"value":52,"context":53},"mitre_attack","T1204.004","User Execution: Malicious Copy and Paste",[18,21,23],{"controls":56,"vendors":138},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":87,"name":88,"problem":89,"products":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,126,131],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":127,"product_name":128,"url":129,"description":130},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":156},"clickfix-social-engineering-turns-trusted-interfaces-into-malware-entry-points","ClickFix Social Engineering Turns Trusted Interfaces Into Malware Entry Points","ClickFix exploits user trust by manipulating individuals into manually pasting malicious commands into legitimate system interfaces like the Windows Run dialog or PowerShell, effectively bypassing traditional endpoint and perimeter security controls. Because the attack originates from user action rather than automated exploitation, signature-based defenses such as antivirus and URL filtering are largely ineffective. The use of compromised legitimate websites and blockchain-based infrastructure further undermines domain blacklisting as a defensive strategy. This technique has become the leading cause of enterprise network intrusions according to Microsoft, highlighting how human behavior remains the most critical and underprotected attack surface. Organizations that rely solely on technical controls without investing in user education and behavioral monitoring are particularly vulnerable.",[144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 5: Account Management","CIS Control 8: Audit Log Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1059: Command and Scripting Interpreter","GDPR Article 32: Security of Processing (where personal data is at risk)",{}]