The malware targets macOS users only and serves commodity infostealers.

A critical-level flaw in a popular CMS, patched months ago, is now being abused.

Ghost CMS flaw CVE-2026-26980 enabled attacks on 700+ sites, injecting ClickFix malware through fake CAPTCHA pages.

Ghost CMS SQL injection campaign has compromised 700+ websites — including Harvard University, Oxford University, and DuckDuckGo — using a CVSS 9.4 flaw to inject ClickFix malware lures that trick ...

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious ...

Exploitation of open-source tools allows attackers to maintain persistent access after initial social engineering, warn ReliaQuest researchers ...

A clever malware deployment scheme first spotted in targeted attacks last year has now gone mainstream. In this scam, dubbed “ClickFix,” the visitor to a hacked or malicious website is asked to ...

Use of the ClickFix attack vector has shot up by 517% since the second half of 2024, making it the second most abused attack vector behind phishing. The attack uses a fake reCAPTCHA to trick users ...

Security experts reveal how easy it is to get fooled by this scam and what to do if you think you've been targeted.

ClickFix campaigns are gaining steam according to various security researchers, with recent campaigns spotted across the globe from a wide swath of cyberattackers. The increasingly popular tactic ...