[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTQjez7dvezRTzaEf5Dq-xOEUT79s3f5Oa71oN3KWe_E":3},{"article":4,"iocs":56,"watch_terms":65,"solutions":66,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"20f93690-2c1e-4e41-b3d6-2bd56f3942a1","New ClickFix Attack Uses Node.js Malware via Tor to Steal Crypto","new-clickfix-attack-uses-node-js-malware-via-tor-to-steal-crypto","Netskope Threat Labs report a new ClickFix attack using fake CAPTCHAs to deploy Tor-backed NodeJS malware and drain crypto wallets on Windows.","Netskope Threat Labs uncovered a professional Malware-as-a-Service (MaaS) operation called ClickFix that tricks Windows users via fake CAPTCHA prompts into downloading a Node.js-based Remote Access Trojan (RAT). The malware uses Tor for C2 communication, stays hidden in memory, and targets cryptocurrency wallets by checking for 30+ security products before executing theft operations. Researchers discovered the attackers' exposed admin panel, revealing the use of gRPC protocol for real-time wallet tracking and Telegram-based alerts to affiliate scammers.","ClickFix campaign uses fake CAPTCHAs to deploy Node.js RAT malware via Tor to steal crypto.","https:\u002F\u002Fhackread.com\u002Fclickfix-attack-node-js-malware-tor-steal-crypto\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002Fclickfix-attack-node-js-malware-tor-steal-crypto-2.jpg","2026-04-08T09:15:51+00:00","2026-04-08T10:00:23.319949+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"ClickFix","campaign",{"name":21,"type":22},"Node.js","technology",{"name":24,"type":22},"Tor",{"name":26,"type":22},"gRPC",{"name":28,"type":29},"Netskope","vendor",{"name":31,"type":32},"Windows Defender","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60,63],{"type":37,"value":58,"context":59},"NodeServer-Setup-Full.msi","Node.js-based RAT installer deployed via fake CAPTCHA clicks",{"type":37,"value":61,"context":62},"LogicOptimizer","Windows Registry persistence folder where malware installs itself",{"type":37,"value":18,"context":64},"Campaign name for fake CAPTCHA-based malware distribution",[28,31],{"controls":67,"vendors":147},[68,89,118],{"slug":69,"name":70,"problem":71,"products":72},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[73,81],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[148],{"slug":149,"name":28,"logo_path":150,"roles":151},"netskope","\u002Fvendor-logos\u002Fnetskope.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":164},"clickfix-maas-campaign-exploits-user-trust-with-fake-captchas-to-deploy-crypto-stealing-malware","ClickFix MaaS Campaign Exploits User Trust with Fake CAPTCHAs to Deploy Crypto-Stealing Malware","The ClickFix campaign demonstrates how sophisticated social engineering can bypass technical security controls by exploiting user trust in familiar web elements like CAPTCHA prompts. Users were tricked into manually downloading and executing malicious Node.js payloads that appeared to be legitimate security verification steps. The malware's use of Tor for command and control communication, memory-only persistence, and reconnaissance of security products shows the evolution of crypto-focused threats. This attack highlights the critical importance of user education in recognizing deceptive interfaces and the need for robust endpoint protection against fileless malware.",[158,159,160,161,162,163],"CIS Control 14","CIS Control 8","CIS Control 13","NIST SC-7","NIST SI-4","NIST AT-2",{}]