101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.

Server stats:

484
active users

#clickfix

2 posts2 participants0 posts today
cR0w :cascadia:<p>.hta files are still going strong. In 2025.</p><p><a href="https://www.cloudsek.com/blog/threat-actors-lure-victims-into-downloading-hta-files-using-clickfix-to-spread-epsilon-red-ransomware" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">cloudsek.com/blog/threat-actor</span><span class="invisible">s-lure-victims-into-downloading-hta-files-using-clickfix-to-spread-epsilon-red-ransomware</span></a></p><blockquote><p>During routine infrastructure hunting, CloudSEK’s TRIAD uncovered a Clickfix-themed malware delivery site in active development, associated with the Epsilon Red ransomware. Unlike previous campaigns that copy commands to clipboards, this variant urges victims to visit a secondary page, where malicious shell commands are silently executed via ActiveX to download and run payloads from an attacker-controlled IP. Social engineering tactics, such as fake verification codes, are used to appear benign. Pivoting into related infrastructure revealed impersonation of services like Discord Captcha Bot, Kick, Twitch, and OnlyFans, as well as romance-themed lures. Epsilon Red was first observed in 2021 and is loosely inspired by REvil ransomware in ransom note styling, but otherwise appears distinct in its tactics and infrastructure.</p></blockquote><p><a href="https://infosec.exchange/tags/threatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatIntel</span></a> <a href="https://infosec.exchange/tags/clickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>clickFix</span></a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a></p>
Anna Wasilewska-Śpioch<p>🇵🇱 Szczegółowa analiza techniczna nowej kampanii ukierunkowanych ataków wykorzystujących metodę <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> w celu dostarczenia złośliwego oprogramowania, przygotowana przez Irka Tarnowskiego, który swego czasu napisał sporo dobrych tekstów do <span class="h-card" translate="no"><a href="https://infosec.exchange/@zaufanatrzeciastrona" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>zaufanatrzeciastrona</span></a></span> </p><p>🇬🇧 A detailed technical analysis of a new campaign of targeted attacks using the ClickFix method to deliver malware </p><p><a href="https://medium.com/@ireneusz.tarnowski/dissecting-the-clickfix-user-execution-attack-and-its-sophisticated-persistence-via-ads-54435da7176b" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">medium.com/@ireneusz.tarnowski</span><span class="invisible">/dissecting-the-clickfix-user-execution-attack-and-its-sophisticated-persistence-via-ads-54435da7176b</span></a></p>
ESET Research<p><a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> went from virtually non-existent to the second most common attack vector blocked by <a href="https://infosec.exchange/tags/ESET" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESET</span></a>, surpassed only by <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>phishing</span></a>. This novel social engineering technique accounted for nearly 8% of all detections in H1 2025. <a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESETresearch</span></a><br>ClickFix lures users by displaying bogus error messages followed by quick fix instructions, including copy-pasting malicious code. Running the code in the victim’s command line interpreter delivers malware such as <a href="https://infosec.exchange/tags/RATs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RATs</span></a>, infostealers, and cryptominers.<br>Between H2 2024 and H1 2025, ESET’s detection for ClickFix, HTML/FakeCaptcha, skyrocketed by 517%. Most detections in ESET telemetry were reported from Japan (23%), Peru (6%), and Poland, Spain, and Slovakia (&gt;5% each).<br>What makes <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> so effective? The fake error message looks convincing; instructions are simple, yet the copied command is too technical for most users to understand. Pasting it into cmd leads to compromise with final payloads, including <a href="https://infosec.exchange/tags/DarkGate" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DarkGate</span></a> or <a href="https://infosec.exchange/tags/LummaStealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LummaStealer</span></a>. <br>While <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> was introduced by cybercriminals, it’s since been adopted by APT groups: Kimsuky, Lazarus; Callisto, Sednit; MuddyWater; APT36. NK-aligned actors used it to target developers, steal crypto and passwords from Metamask and <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>macOS</span></a> Keychain. <br><a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> uses psychological manipulation by presenting fake issues and offering quick solutions, which makes it dangerously efficient. It appears in many forms – error popups, email attachments, fake reCAPTCHAs – highlighting the need for greater vigilance online.<br>Read more in the <a href="https://infosec.exchange/tags/ESETThreatReport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESETThreatReport</span></a>:<br>🔗 <a href="https://welivesecurity.com/en/eset-research/eset-threat-report-h1-2025" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">welivesecurity.com/en/eset-res</span><span class="invisible">earch/eset-threat-report-h1-2025</span></a></p>
Randy<p><span class="h-card" translate="no"><a href="https://abyssdomain.expert/@filippo" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>filippo</span></a></span> the copy/paste technique is called <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> . the site in the image is infected by TA2726's Keitaro which is well known for sending Windows folks to <a href="https://infosec.exchange/tags/SocGholish" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SocGholish</span></a> . what they do with macOS folks has changed over the years. i see they sent you to something that delivered what looks like Poseidon Stealer.</p><p><a href="https://medium.com/@MateoPappa/letsdefend-poseidon-macos-stealer-hard-a796c85d8c72" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">medium.com/@MateoPappa/letsdef</span><span class="invisible">end-poseidon-macos-stealer-hard-a796c85d8c72</span></a></p>
Brad<p>2025-07-15 (Tuesday): Tracking <a href="https://infosec.exchange/tags/SmartApeSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SmartApeSG</span></a> </p><p>The SmartApeSG script injected into page from compromised website leads to <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> style fake verification page. ClickFix-ing you way through this leads to a <a href="https://infosec.exchange/tags/NetSupportRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetSupportRAT</span></a> infection.</p><p>Compromised site (same as yesterday): </p><p>- medthermography[.]com</p><p>URLs for ClickFix style fake verification page:</p><p>- warpdrive[.]top/jjj/include.js<br>- warpdrive[.]top/jjj/index.php?W11WzmLj<br>- warpdrive[.]top/jjj/buffer.js?409a8bdbd9</p><p>Running the script for NetSupport RAT:</p><p>- sos-atlanta[.]com/lal.ps1<br>- sos-atlanta[.]com/lotu.zip?l=4773</p><p><a href="https://infosec.exchange/tags/NetSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetSupport</span></a> RAT server (same as yesterday):</p><p>- 185.163.45[.]87:443</p>
ESET Research<p>In May 2025, <a href="https://infosec.exchange/tags/ESET" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESET</span></a> participated in operations that largely disrupted the infrastructure of two notorious infostealers: <a href="https://infosec.exchange/tags/LummaStealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LummaStealer</span></a> and <a href="https://infosec.exchange/tags/Danabot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Danabot</span></a>. <br>As part of the Lumma Stealer disruption effort, carried out in conjunction with Microsoft, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry, ESET supplied technical analysis and statistical information. <br>Danabot was targeted by the <a href="https://infosec.exchange/tags/FBI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FBI</span></a> and <a href="https://infosec.exchange/tags/DCIS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DCIS</span></a>, alongside <a href="https://infosec.exchange/tags/OperationEndgame" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OperationEndgame</span></a> led by <a href="https://infosec.exchange/tags/Europol" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Europol</span></a> and <a href="https://infosec.exchange/tags/Eurojust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Eurojust</span></a>. ESET participated together with several other companies. We provided the analysis of the malware’s backend infrastructure and identified its C&amp;C servers. <br>Before these takedowns, both infostealers were on the rise: in H1 2025, Lumma Stealer detections grew by 21%, while Danabot’s numbers increased by more than 50%.<br> For a time, Lumma Stealer was the primary payload of HTML/FakeCaptcha trojan, used in the <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> social engineering attacks that we also cover in this issue of the <a href="https://infosec.exchange/tags/ESETThreatReport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESETThreatReport</span></a>. In recent months, we have seen Danabot being delivered via ClickFix as well. <br>For more details on these two operations and on the ClickFix attacks, read the latest <a href="https://infosec.exchange/tags/ESETThreatReport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESETThreatReport</span></a>: <a href="https://welivesecurity.com/en/eset-research/eset-threat-report-h1-2025" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">welivesecurity.com/en/eset-res</span><span class="invisible">earch/eset-threat-report-h1-2025</span></a></p>
Brad<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@badsamurai" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>badsamurai</span></a></span> That's basically my point. <a href="https://infosec.exchange/tags/FileFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FileFix</span></a> is just <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> by another name. Trying to separate the two doesn't make sense to me.</p><p>Definitely agree that your mitigation is a good way to help combat this.</p>
Brad<p><a href="https://infosec.exchange/tags/Example" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Example</span></a> 3: <a href="https://infosec.exchange/tags/TermFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TermFix</span></a> </p><p>I rarely see this, and I haven't yet personally documented it. So I found an image from a Google search to illustrate.</p><p>This example is from a <a href="https://infosec.exchange/tags/TermFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TermFix</span></a> style <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> popup asking the viewer to open a PowerShell terminal.</p>
Brad<p>Example 2: <a href="https://infosec.exchange/tags/FileFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FileFix</span></a> </p><p>As of 2025-07-03, the <a href="https://infosec.exchange/tags/KongTuke" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>KongTuke</span></a> campaign is using FileFix style <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> pages to distribute whatever this campaign is distributing. </p><p>It's likely pushing <a href="https://infosec.exchange/tags/InterlockRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InterlockRAT</span></a> based on previous discussions I've had here, but I couldn't confirm, because it didn't like me.</p>
Brad<p>Example 1: <a href="https://infosec.exchange/tags/RunFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RunFix</span></a></p><p>As of 2025-07-03, the <a href="https://infosec.exchange/tags/SmartApeSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SmartApeSG</span></a> campaign is using RunFix style <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> pages to distribute <a href="https://infosec.exchange/tags/NetSupportRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetSupportRAT</span></a></p>
Brad<p><a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> is a social engineering technique that uses fake verification pages and clipboard hijacking to convince people to click and keyboard stroke their way to an infection. So let's categorize <a href="https://infosec.exchange/tags/FileFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FileFix</span></a> properly in the pantheon of ClickFix Attacks.</p><p>FileFix: A ClickFix page that asks you to past script into a File Manager window.</p><p><a href="https://infosec.exchange/tags/RunFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RunFix</span></a>: A ClickFix page that asks you to paste script into a Run window</p><p><a href="https://infosec.exchange/tags/TermFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TermFix</span></a>: A ClickFix page that asks you to paste script into a terminal window (cmd.exe console or PowerShell terminal).</p><p>We cool with that? Any others types I'm missing?</p>
ESET Research<p>ESET Threat Report H1 2025: <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> attacks surge 500%, SnakeStealer tops infostealer charts, and NFC fraud jumps 35x. Plus, chaos in the ransomware underworld and a new Android adware menace—Kaleidoscope. Dive into the full report: <a href="https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">web-assets.esetstatic.com/wls/</span><span class="invisible">en/papers/threat-reports/eset-threat-report-h12025.pdf</span></a> <a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ESETresearch</span></a></p>
The New Oil<p>New <a href="https://mastodon.thenewoil.org/tags/FileFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FileFix</span></a> attack weaponizes <a href="https://mastodon.thenewoil.org/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Windows</span></a> <a href="https://mastodon.thenewoil.org/tags/FileExplorer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FileExplorer</span></a> for stealthy commands</p><p><a href="https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a></p>
Hackread.com<p>🚨 New malware alert: Mocha Manakin uses <a href="https://mstdn.social/tags/Clickfix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Clickfix</span></a> (fakeCAPTCHA) to trick users into deploying a custom backdoor called NodeInitRAT. Red Canary warns it could lead to ransomware!</p><p> 🔗 <a href="https://hackread.com/mocha-manakin-malware-nodeinitrat-via-clickfix-attack" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/mocha-manakin-mal</span><span class="invisible">ware-nodeinitrat-via-clickfix-attack</span></a></p><p><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mstdn.social/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberAttack</span></a> <a href="https://mstdn.social/tags/fakeCAPTCHA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fakeCAPTCHA</span></a> <a href="https://mstdn.social/tags/MochaManakin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MochaManakin</span></a> <a href="https://mstdn.social/tags/NodeInitRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NodeInitRAT</span></a></p>
Brad<p>2025-06-18 (Wednesday): <a href="https://infosec.exchange/tags/SmartApeSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SmartApeSG</span></a> --&gt; <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> lure --&gt; <a href="https://infosec.exchange/tags/NetSupportRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetSupportRAT</span></a> --&gt; <a href="https://infosec.exchange/tags/StealCv2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>StealCv2</span></a></p><p>A <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcap</span></a> of the traffic, the malware/artifacts, and some IOCs are available at <a href="https://www.malware-traffic-analysis.net/2025/06/18/index.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">025/06/18/index.html</span></a>.</p><p>Today's the 12th anniversary of my first blog post on malware-taffic-analysis.net, so I made this post a bit more old school.</p>
Hackread.com<p>🚨 Researchers warn of a surge in <a href="https://mstdn.social/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClickFix</span></a> scams impersonating <a href="https://mstdn.social/tags/Booking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Booking</span></a>.com. Fake CAPTCHAs trick users into running malware like XWorm and DanaBot.</p><p>Read: <a href="https://hackread.com/clickfix-email-scam-fake-booking-com-emails-malware/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/clickfix-email-sc</span><span class="invisible">am-fake-booking-com-emails-malware/</span></a></p><p><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> <a href="https://mstdn.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://mstdn.social/tags/XWorm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>XWorm</span></a> <a href="https://mstdn.social/tags/DanaBot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DanaBot</span></a> <a href="https://mstdn.social/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Scam</span></a></p>

Infostealery rozprzestrzeniają się przez TikTok i technikę ClickFix – szczegóły techniczne kampanii

W ostatnich tygodniach badacze bezpieczeństwa zaobserwowali nietypową, skuteczną kampanię malware, w której cyberprzestępcy wykorzystują popularność TikToka do dystrybucji złośliwego oprogramowania typu infostealer (m.in. Vidar, StealC, Latrodectus). Atak opiera się na tzw. technice ClickFix, polegającej na nakłanianiu użytkowników do samodzielnego uruchamiania złośliwych poleceń PowerShell. Poniżej przedstawiamy szczegółową analizę tej kampanii oraz...

#WBiegu #Clickfix #Malware #Rejestr #Sideloading #Tiktok

sekurak.pl/infostealery-rozprz

Sekurak · Infostealery rozprzestrzeniają się przez TikTok i technikę ClickFix – szczegóły techniczne kampaniiW ostatnich tygodniach badacze bezpieczeństwa zaobserwowali nietypową, skuteczną kampanię malware, w której cyberprzestępcy wykorzystują popularność TikToka do dystrybucji złośliwego oprogramowania typu infostealer (m.in. Vidar, StealC, Latrodectus). Atak opiera się na tzw. technice ClickFix, polegającej na nakłanianiu użytkowników do samodzielnego uruchamiania złośliwych poleceń PowerShell. Poniżej przedstawiamy szczegółową analizę tej kampanii oraz...