Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.

TerminalFix uses fake Cloudflare CAPTCHA pages to trick users into running PowerShell malware, creating reverse tunnels that ...

WordlistLoader delivers Amatera via ClearFake ClickFix attacks, while SynkLoader uses Teams phishing to steal Windows login ...

CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft ...

Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The ...

TerminalFix is a new ClickFix campaign that tricks users into running PowerShell commands and turns infected Windows PCs into network pivots.

The software supply chain is no longer just code and dependencies — it’s a web of trust connecting developers, AI agents, ...

Microsoft is warning that a campaign using fake human-verification prompts can turn a user's Windows computer into an entry point for attackers to reach an organization's internal network .

Anthropic has just published the results of a protein design campaign. Fifteen targets, a written brief and an instruction to ...

Explore browser casting and a DIY remote app that turn your Windows 11 PC into a practical Google TV command center.

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, ...