A new and dangerous malware called Clickfix is
tricking users through fake browser notifications. These alerts often display
messages like “Fix Now” or “Bot Verification” to make people think their device
is at risk or needs attention.
When clicked, these alerts start a hidden infection
process that installs malware. This malware can:
- Steal passwords and sensitive information
- Record what you type (keylogging)
- Give hackers remote access to your device
The Clickfix attack often starts when users visit a
compromised website or click a malicious ad. The website shows a fake warning
message that looks like a real browser alert, such as:
- “Your system is infected!”
- “Bot check – click to verify”
These messages are designed to create fear or
urgency. Once the user clicks the alert, hidden code runs in the background.
That code downloads a harmless-looking file, like a
fake PDF or system tool. But hidden inside is a PowerShell command that
silently installs the real malware from a hacker-controlled server.
Researchers from Hunt.io found that Clickfix is
hard to stop because it:
- Uses obfuscated JavaScript (scrambled code to avoid detection)
- Adapts based on your browser language and behavior
- Uses fileless techniques, meaning it doesn’t store malware files
like normal viruses
- Changes its command servers often (more than 38 in one month)
It also creates several persistence tricks, so it
keeps running even after restarts or attempted removal.
Once on your device, the malware starts looking
for:
- Saved passwords
- Cryptocurrency wallet details
- Financial account logins
- Any typed information (via keylogging)
How to Protect Yourself
Security experts recommend the following to stay
safe:
- Avoid clicking suspicious browser alerts or pop-ups
- Only visit trusted websites
- Keep your browser and system fully updated
- Use advanced antivirus tools that detect strange behavior, not just
known viruses
- Use browser security policies in business environments
Being aware of these tricks can help stop attacks before they succeed. If something looks suspicious, it probably is — don’t click! Invest today in our Cybersecurity tool to protect you. You can buy our cybersecurity solution today to protect yourself
