ClickFix Campaigns Abuse Legitimate Services for Persistent Access
Two separate campaigns, utilizing ClickFix-style social engineering tactics, demonstrate the evolving sophistication of threat actors in exploiting legitimate services for persistent access and financial gain. One campaign targeted a Ukrainian government entity, leveraging a fake Google CAPTCHA to deploy an infostealer (Amatera) and a reverse proxy, while another campaign began with a browser-based attack and expanded to compromise Google services, ultimately aiming to establish network persistence for potential ransomware attacks. Both campaigns highlight the increasing reliance on trusted services like Google Sheets and Cloudflare to deliver malicious payloads and evade traditional security measures.
Two separate campaigns demonstrate how threat actors are finding new ways to compromise organizations by using the popular social engineering tactic. Researchers from Cisco Talos discovered both campaigns, which use different delivery methods, but both rely on the victim to take a seemingly routine action to compromise themselves. The link between the two was not only in their use of social engineering attacks, commonly known as ClickFix and ClearFake, but also in how they abused legitimate services and assets to make the malicious activity resemble typical user or application behavior.
“Both operations turn the victim into an active part of the infection chain and abuse services or technologies that users and defenders already trust, Google Sheets, Cloudflare Workers, public blockchain endpoints, for command and control,” observes Denis Calderone, principal and chief technology officer at Suzu Labs. “The malicious traffic looks like normal business activity, so domain-based blocking isn't going to catch it.”
New Attacks Demonstrate ClickFix Diversity
In one attack, aimed at stealing cryptocurrency, threat actors used a ClickFix-style approach to coerce users into pasting malicious code that can alter transaction interface pages in Chrome or add it through a browser extension. In a deviation from typical ClickFix attacks, the attackers convince potential victims to retrieve and enter malicious browser code from a publicly available Google Sheet, using a legitimate Google service as part of their infrastructure.
The other attack on a Ukrainian government organization by a Russian threat actor began in April 2026 with an investigation into a DLL called verification.google executing from WebDAV at that organization. Upon further scrutiny, the researchers traced an attack that started with a compromised website displaying a fake Google CAPTCHA that uses the ClickFix technique to trick victims into pasting a command into the Windows Run dialog. That command retrieves a disguised dynamic link library (DLL) file over WebDAV and launches the Amatera infostealer, which can harvest cryptocurrency data, credentials, browser information, and sensitive files. One branch of the malware also deployed a cryptocurrency stealer and reverse proxy, while another installed NetSupport Manager to give attackers remote control of the infected system.
Though just one organization prompted the investigation, the researchers eventually realized that “the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.”
Defending Against ClickFix Variants
Researchers from Proofpoint first spotted ClickFix attacks about two years ago, and the technique has become a favorite of the cybercriminal community since then. The ultimate aim of the attack is to trick a user into executing malicious prompts against themselves, which is why they are such a successful vector for attackers. “Both of these campaigns abuse services defenders already trust, Google Sheets, Cloudflare Workers, public blockchain endpoints, for command and control,” observes Denis Calderone, principal and chief technology officer at Suzu Labs. “The malicious traffic looks like normal business activity, so domain-based blocking isn't going to catch it.”
As these and other recently discovered ClickFix attacks demonstrate, new attacks that leverage this malicious prompt as the initial vector are starting to find their way deeper in the network and other services. Not only are threat actors using these prompts to launch infostealers to harvest credentials, they’re increasingly aiming to achieve both network persistence as initial access brokers for potential ransomware attacks, as well as financial gain through cryptocurrency theft.
To defend against these threats, Cisco Talos included indicators of compromise (IoCs) for each attack in the respective reports. As a general rule, the researchers also recommend that organizations take steps to more closely manage users’ browsers, limiting use of developer-level functionality and deployment of browser extensions based on role. “Defenders should treat the browser as a managed execution environment, not simply as a tool used to reach websites,” Svajcer says. Another defense measure is to warn employees and customers of social engineering techniques and the dangers of modifying browser behavior through copy-and-paste code, he adds. Specifically, Svajcer says they should “educate users that no legitimate CAPTCHA, verification workflow, vulnerability report or support process should require them to paste code into the address bar, an extension, the Run dialog, PowerShell, or a terminal.”