[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUmaom82bN0r3olbZVLzmmVjoq1l1y7vd19A2pK9BERw":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"4eb0a6cf-5042-4d4a-bb92-cd2167525fda","ClickFix Campaigns Abuse Legitimate Services for Persistent Access","clickfix-campaigns-abuse-legitimate-services-for-persistent-access-c52966","Two separate attacks demonstrate how threat actors are finding new ways to compromise organizations by using the popular social engineering tactic.","Two distinct campaigns, dubbed ClickFix, have been observed abusing legitimate cloud services to gain persistent access within victim environments. These attacks rely on social engineering tactics to trick users into executing malicious payloads, which then establish a foothold using cloud-based infrastructure. The methods employed highlight a growing trend of threat actors leveraging trusted services to evade detection and maintain access.","ClickFix campaigns leverage legitimate services for persistent access via social engineering.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fclickfix-campaigns-legitimate-services-persistent-access","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt96e63b09ee56a517\u002F6aa00b69572e2132fa0a49b3\u002FWomantyping_Rawpixel.com_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-09-08T17:25:37+00:00","2026-09-08T18:00:14.124901+00:00",7,[17],{"name":18,"type":19},"ClickFix","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":20,"icon":22,"name":23,"slug":24},null,"Threat Intelligence","threat-intelligence",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},[],[],{"controls":41,"vendors":124},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":72,"name":73,"problem":74,"products":75},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":101,"name":102,"problem":103,"products":104},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[105,110,117],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":106,"product_name":107,"url":108,"description":109},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":101,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":142},"clickfix-campaigns-use-trusted-cloud-services-to-trick-users-and-evade-detection","ClickFix Campaigns Use Trusted Cloud Services to Trick Users and Evade Detection","ClickFix campaigns exploit social engineering to manipulate users into voluntarily executing malicious payloads, bypassing many traditional security controls. By abusing legitimate cloud services such as trusted SaaS platforms, attackers blend malicious traffic with normal business activity, making detection significantly harder. This highlights a critical gap in user awareness training and the limitations of perimeter-based defenses when attackers operate through trusted channels. Organizations that lack behavioral monitoring and robust endpoint controls are especially vulnerable to this style of persistent access establishment.",[130,131,132,133,134,135,136,137,138,139,140,141],"CIS Control 3: Data Protection","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST SP 800-53 AC-3: Access Enforcement","MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1102: Web Service (C2 via legitimate services)","NIST CSF DE.CM-1: Network Monitoring","ITIL 4: Problem Management — root cause analysis of recurring social engineering incidents",{}]