high advisory July 6, 2026 updated

ClickFix Campaign Activity

Tracking brief for the ClickFix campaign; individual sightings are folded in as reported.

What's new

1. new IOCs Sep 24, 14:07 via securelist
2. new product Sep 23, 08:02 via risky-biz
3. new product Sep 21, 06:59 via malware-traffic-analysis
4. new product Sep 18, 10:28 via securityweek
5. new IOCs Sep 15, 09:27 via securityweek

This brief tracks activity attributed to the ClickFix campaign. Sightings and indicators from separate reports are folded in as they are published, rather than creating a separate brief per report.

Recommendation

Review the collected indicators and references and hunt for ClickFix delivery patterns across endpoint and network telemetry.

Indicators of compromise

domain

hash_sha256

url

Type	Value
domain	justwatch.com
ip	136.243.203.109
domain	pool.supportxmr.com
domain	ip-api.com
domain	.gov.br
domain	us.zoom.06webin.us
url	https://pewtercanto.top/user/throttle-effect.js
url	https://pewtercanto.top/user/acl-dom?JSMlAATp
url	https://pewtercanto.top/user/version-deploy.js?18c7713e5fb5a572
url	http://deltaode.com/po
domain	apricotfilepoint.com
domain	filecopperbasket.com
domain	filevelvettractor.com
domain	fileoceanhammer.com
domain	filemarblegarden.com
domain	debug.allllowef.space
ip	193.29.224.151
domain	rowanportico.global
url	https://rowanportico.global/identity/realm-xml.js
url	https://rowanportico.global/identity/role-template?xPM7XYCZ
url	https://rowanportico.global/identity/secure-theme.js?18cddb5baf41fce0
url	http://lagoonandledger.com/crol
domain	gitnow.dev
hash_sha256	18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f
domain	bestsocialmedianewspapper.com
domain	offlineupdater.com
domain	leaguejazire.com
domain	riyazinikokar.xyz
domain	hbomaxx.us
url	http://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08