Loading story…
BlueVoyant and other researchers reported that the Lorem Ipsum malware operation abandoned Trojanized Microsoft Teams installers signed with fraudulent Microsoft Trusted Signing certificates and moved to ClickFix lures hosted on compromised WordPress sites. The change followed Microsoft’s disruption of the Fox Tempest malware-signing-as-a-service ecosystem and revocation of more than 1,000 fraudulently obtained certificates, which undercut the group’s earlier delivery method. BlueVoyant assessed with high confidence that the activity is tied to Rapid Brigantine—also tracked as Vanilla Tempest, DEV-0832, and Vice Society—a financially motivated actor linked to ransomware and data extortion.
The updated infection chain uses fake browser updates or CAPTCHA-style prompts to socially engineer victims into running malicious commands, expanding targeting beyond users searching for fake Teams downloads. Researchers said the malware relies on a multistage loader, DLL sideloading, encrypted payloads, and dead-drop command-and-control through LetsDiskuss[.]com, while parallel ClickFix campaigns have also delivered loaders such as BabaDeda, Potemkin, and GULoader using in-memory execution and remote DLL loading via rundll32.exe. The reporting underscores ClickFix as a durable initial-access technique on compromised websites that can lead to stealers, RATs, remote management tools, and hands-on-keyboard post-compromise activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Apple added a warning in macOS Tahoe 26.4 about pasting commands into Terminal in response to the durability of ClickFix-style social engineering. The change was highlighted as a defensive response affecting macOS users.
Researchers reported multiple ClickFix-driven malware campaigns in 2026 delivering BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. The campaigns used social engineering to get users to run malicious commands and then deployed modular loaders for stealers, RATs, and follow-on tooling.
BlueVoyant assessed with high confidence that the Lorem Ipsum activity is linked to Rapid Brigantine, also known as Vanilla Tempest, DEV-0832, and Vice Society. The reporting described the actor as financially motivated and associated with ransomware and data extortion activity.
In late May 2026, the Lorem Ipsum campaign pivoted from signed fake Teams installers to ClickFix lures hosted on compromised WordPress sites. The new chain used fake browser update prompts and socially engineered PowerShell execution to silently install the malware and broaden the victim pool.
Microsoft disrupted the Fox Tempest malware-signing-as-a-service infrastructure and revoked more than 1,000 fraudulently obtained certificates. BlueVoyant said this action made Lorem Ipsum's prior signed-installer delivery method impractical.
BlueVoyant reported that the Lorem Ipsum malware campaign initially delivered trojanized Microsoft Teams installers signed with fraudulent Microsoft Trusted Signing certificates. This earlier delivery method targeted users seeking fake Teams downloads before the operators changed tactics.
Sicuranext documented a campaign first observed in April 2026 that used compromised WordPress sites, EtherHiding on the BNB Smart Chain Testnet, and a fake CAPTCHA ClickFix lure to trick Windows users into executing a malicious rundll32 command. The infrastructure was attributed to GULoader and designed to execute malware in memory while evading SmartScreen and antivirus tools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcebluevoyant.com
Open sourcedarkreading.com
Open sourcebluevoyant.com
Open sourcecookie.engineer
Open sourcesocura.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 15, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026