- Facts checked on 7 Oct 2026 against the source the post cites (Dark Reading, Alexander Culafi, 6 Oct 2026) and the primary research it reports (Flare's CrocoRat write-up by Assaf Morag, 6 Oct 2026). Production's summary was accurate. Two refinements: the "quieter foothold" reading comes from a Flare spokesperson, and the defensive advice is Morag's, apart from script-block logging, which Microsoft also recommends. Fact-check, 7 Oct: rechecked against both sources. Flare's write-up says standalone machines get two stealers (one for browser credentials and wallet seeds, one for wallet data), so "a wallet stealer" became "credential and wallet stealers". The Microsoft post on X couldn't be opened from here; click-test it.
- Byline: production credits "Content Team" and dates the post 7 Oct 2026.
- Hero CTAs as on every page. Ticker posts are news, not educational content, so the offer is the sample evidence pack band, not a guide.
ClickFix attacks are getting sneakier about hiding their payloads.
Two new campaigns move the next stage of the attack out of the command victims paste, so defenders see less of it. Researchers at Flare and Microsoft Threat Intelligence have described both.
- Template rule for every ticker post: facts from the cited source only, checked against the primary research where the source links to it; the source in the byline and in the list; one "What it means for software you depend on" box; the evidence pack band; the final CTA.
- Not used: production's closing "Have questions about protecting your software? Our escrow experts are standing by to help. Book a free demo" (a CTA variant the brief rules out).
ClickFix is a social engineering trick. A fake error or "verify you're human" prompt tells the victim to paste a command into the Windows Run dialog, PowerShell or the macOS Terminal. Two new campaigns change what happens after the paste.
The next stage arrives by DNS
Flare researcher Assaf Morag described a campaign spreading CrocoRat, a previously undocumented remote access trojan and cryptocurrency stealer. The lure is a fake reCAPTCHA check with spoofed Cloudflare branding.
The pasted command queries a DNS TXT record on a server the attackers control, and the record returns the next instruction. The second stage never appears in the command on the victim's clipboard, which leaves investigators less to work with.
Flare also found a Python launcher in the package that hadn't been run. It's built to check whether a machine looks enterprise-managed or standalone, then give corporate-looking machines the remote access trojan only, and standalone machines credential and wallet stealers as well. A Flare spokesperson told Dark Reading the operator may prefer a quieter foothold on corporate targets, to avoid detection.
A payload waiting in the browser cache
Microsoft Threat Intelligence reported a separate campaign that runs through a cluster of compromised websites. The site pre-fetches a script into the browser cache, disguised as a PNG image, before the fake prompt appears. When the victim runs the pasted command, the payload is already on the machine, which also gets around the character limit of the Run dialog.
What the researchers recommend
- Restrict or alert on clipboard-to-Run execution patterns.
- Harden PowerShell logging and enable script-block logging.
- Use application control rules that stop interpreters running from writable directories.
- Train staff on the tells: fake CAPTCHA pages, "press Windows+R" and "paste this command" instructions, and "verification failed" prompts.
- Dark Reading: ClickFix attacks evolve to better hide malicious payloads (Alexander Culafi, 6 Oct 2026)
- Flare: CrocoRat, ClickFix and DNS payload delivery (Assaf Morag, 6 Oct 2026)
- Microsoft Threat Intelligence on X
Facts checked against these sources on 7 Oct 2026.
News ticker
More from the ticker.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Keep your software running. Whatever happens.
See how each protection keeps a way back to the applications you can't lose, whatever happens to the vendor.