Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

A researcher has analyzed 3,000 live ClickFix payloads, shedding light on the malware's delivery mechanism. The ClickFix technique deceives users into manually executing malware by displaying fake "prove you're human" pages. These pages are now being controlled by API-driven servers, which distribute the same malware in varying disguises to each visitor. Additionally, the research uncovered a new delivery method designed to evade Windows' script scanning capabilities. This development suggests that the ClickFix malware is becoming more sophisticated in its tactics. The use of API-driven servers allows for more efficient and dynamic malware distribution.