#ClickFix is an active hashtag on Bluesky. In the last 30 days, 31 people shared 92 posts with it — around 3 a day. Activity is up 37% versus the previous week, peaking on Sep 21 with 10 posts.
Tags most often used together with #ClickFix.
hackread.com
ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers
Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.
www.bleepingcomputer.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]
discourse.ifin.network
Compromised Website Hosting ClickFix Payload Leads to NetSupport RAT Infection
Last Updated: 7/1/2026 What’s Happening A recent trending post by a Mastodon user caught my attention since I actively track ClickFix campaigns: BLUF: The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for...
www.spreaker.com
Brevo Supply Chain Attack: Malware Injected Into 100,000+ Websites
https://www.osintinvestigate.com A major cybersecurity incident involving Brevo exposed more than 100,000 websites to malicious code. In this episode, we examine how attackers compromised Brevo, abused a long-lived Cloudflare API key, and used a malicious Cloudflare Worker to inject scripts into Brevo services and JavaScript assets embedded by customers. The attack also involved ClickFix social engineering and attempts to install malicious WordPress plugins when administrators visited affected websites. We explain the September 2026 timeline, how the attack worked, why supply chain compromises can have such a wide impact, and what website administrators should check after the incident.
hackread.com
ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers
Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.
blog.b-son.net
SPOON SPORTS 不正アクセスでWebサイト改ざん・ClickFix誘導 2026年9月4日 | セキュリティ事件簿#2026-654
株式会社スプーンは2026年9月4日、SPOON SPORTS公式サイトへの不正アクセスと改ざんを公表。ClickFix型の偽画面により不正コマンドが実行された事例も確認され、個人情報への影響は調査中です。公式発表をもとに経緯と対応を整理します。
cyberveille.ch
ChainScript : un RAT Node.js utilisant la blockchain Polygon pour sa découverte C2
Cet article présente l'analyse technique complète d'un RAT Node.js jusqu'alors non documenté, désormais suivi sous le nom ChainScript. La découverte a eu lieu lors d'une investigation sur une campagne ClickFix.
cyberveille.ch
Cyberattaque chez Brevo : injection ClickFix via clé API Cloudflare compromise, 100 000 sites exposés
📰 Source : FrenchBreaches — publié le 18 septembre 2026. L'article rapporte deux incidents de sécurité distincts ayant touché Brevo (anciennement Sendinblue), entreprise française de marketing et CRM basée à Paris. 🔓 Incident principal — 14 septembre 2026 : attaque via clé API Cloudflare Des attaquants ont obtenu une clé API Cloudflare disposant de permissions importantes appartenant à Brevo.
Posts are pulled live from Bluesky and cached briefly. Posts with content labels are hidden.
![Fake CAPTCHA page from KongTuke domain, scrroeder[.]com.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:v3kgm6hujff4gbxies5vwbnb/bafkreielwil5fxjm3tv2gkrdwcv4airp2xlmojctkj7wjgyzh7ogo7bfzu)
