17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360

ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read

CTM360 reports that ClickFix used more than 17,000 compromised URLs, including fake Cloudflare verification pages, to persuade visitors to execute attacker-provided commands; approximately 3,000 URLs were still serving the lure during the analysis. The report describes user-assisted, often fileless malware delivery that can evade defenses focused on exploits, attachments, or malicious domains. The article does not establish that AI was involved, so the AI-specific classification is limited; RealGround analysis maps the broader malicious-use and social-engineering risk to security strategy and adversarial testing for AI-enabled workflows that could be abused to distribute or execute similar payloads.