ClickFix Campaign Activity
Tracking brief for the ClickFix campaign; individual sightings are folded in as reported.
What's new
- 1. new IOCs Aug 18, 20:50 via huntress
- 2. new IOCs Aug 17, 11:47 via the-hacker-news
- 3. new IOCs Aug 11, 07:48 via the-hacker-news
- 4. new IOCs Aug 5, 21:15 via microsoft-threat-intel
- 5. new IOCs Aug 1, 19:48 via malware-traffic-analysis
This brief tracks activity attributed to the ClickFix campaign. Sightings and indicators from separate reports are folded in as they are published, rather than creating a separate brief per report.
Recommendation
Review the collected indicators and references and hunt for ClickFix delivery patterns across endpoint and network telemetry.
Indicators of compromise
11
domain
2
ip
4
url
| Type | Value |
|---|---|
| domain | justwatch.com |
| ip | 136.243.203.109 |
| domain | pool.supportxmr.com |
| domain | ip-api.com |
| domain | .gov.br |
| domain | us.zoom.06webin.us |
| url | https://pewtercanto.top/user/throttle-effect.js |
| url | https://pewtercanto.top/user/acl-dom?JSMlAATp |
| url | https://pewtercanto.top/user/version-deploy.js?18c7713e5fb5a572 |
| url | http://deltaode.com/po |
| domain | apricotfilepoint.com |
| domain | filecopperbasket.com |
| domain | filevelvettractor.com |
| domain | fileoceanhammer.com |
| domain | filemarblegarden.com |
| domain | debug.allllowef.space |
| ip | 193.29.224.151 |