Category: Blog Posts

Part 1 explained how ClickFix and TerminalFix work from the attacker’s perspective. In Part 2, we recreate the complete attack chain in a controlled environment, following the stages described in the BSI paper. For each stage, we also look at which security controls could have prevented or stopped the attack. Part 3 focuses on detection:…

ClickFix Did It Again We’ve been tracking ClickFix and its growing family of variants in our SOC for about two years now. At some point last year, our SOC colleagues were already wondering if ClickFix was still worth talking about. By now, you might expect both security teams and users to know one simple rule:…