[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7nNG3Vel3iXGRwdQQIJuavWtrYWZg3D7JvG2fPGY7uI":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":27},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"53d97eff-a4a7-405c-9df0-594d87afd0ca","Beyond the clipboard: The evolving tradecraft of ClickFix","beyond-the-clipboard-the-evolving-tradecraft-of-clickfix-27c9cf","ClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node.js RATs and cache seeing.","Threat actors are continuously evolving their ClickFix social engineering tactics, employing new methods for initial access and payload delivery. Recent campaigns utilize malvertising, SEO poisoning, and compromised websites to lure victims. Attackers are also experimenting with advanced techniques such as hidden PNG payloads, Node.js RATs, and lateral movement following initial ClickFix execution.","ClickFix social engineering tactics evolve with new delivery and payload techniques.","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fthe-evolving-tradecraft-of-clickfix","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Ff4fa7a7e631749c3b577ac5524769d48","2026-11-10T14:00:00+00:00","2026-11-11T08:00:25.8727+00:00",7,[17,20,22],{"name":18,"type":19},"GPTs","product",{"name":21,"type":19},"Node.js",{"name":23,"type":24},"Thomson Reuters","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":27,"name":28,"slug":29},null,"Threat Intelligence","threat-intelligence",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},[44,48],{"type":45,"value":46,"context":47},"domain","vvestalw.ghost.io","Typosquatted domain used in a ClickFix campaign mimicking Westlaw.",{"type":45,"value":49,"context":50},"westlaw-signon.com","Fake Westlaw sign-on page used in a ClickFix campaign.",[23,18,21],{"controls":53,"vendors":137},[54,81,110],{"slug":55,"name":56,"problem":57,"products":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[59,65,73],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":60,"product_name":61,"url":63,"description":64},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,122,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":119,"url":120,"description":121},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":111,"product_name":134,"url":135,"description":136},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[143],"reported_by"]