Cybersecurity
CTM360 maps ClickFix malware delivery chain
CTM360 said its report traced ClickFix campaigns through more than 17,000 URLs, on-chain lure rotation and a compromised WordPress host, ending in Vidar Stealer on a signed Microsoft process.
- CTM360 said it combined campaign-level and host-level analysis in a report on ClickFix.
- The campaign analysis covered more than 17,000 infected URLs using fake Cloudflare verification pages, with around 3,000 still serving the lure at the time of writing.
- The report said one chain used a Polygon smart contract to change lure hostnames and also relied on Telegram and Steam to resolve command-and-control details.
- Microsoft was cited as saying 47% of its Defender Experts initial-access cases in 2025 involved ClickFix, while ESET and MITRE were cited for rise measurements and a March 2025 technique designation.
- Sekoia’s June 2026 analysis was said to link the same Polygon contract to a cluster that distributes Vidar exclusively.
The report described ClickFix as a social-engineering technique in which a web page presents a problem, gives the user instructions and then gets the user to paste a command into a trusted system interface. It said the method avoided exploits, attachments and ordinary browser downloads.
CTM360 said the campaign infrastructure did not rely on attacker domains inside the compromised pages. Instead, a smart contract on Polygon returned the current lure host, and the report said Telegram channel descriptions and a Steam profile were also used to resolve control-server details.
The report said the targeting logic changed by visitor and platform. In the sample it examined, Windows was enabled, macOS and Linux pages were prepared, mobile was disabled and repeat visitors were suppressed for 90 days.
For one host, CTM360 said machine and account details were built into the download path so the server could choose a payload per machine or send nothing. In the WordPress case, the loader was added by PHP to dynamic responses and was accompanied by about two dozen backdoor administrator accounts.
CTM360 said one analysed chain ended with Vidar Stealer running inside a signed Microsoft binary through DLL side-loading. It also said Sekoia had previously connected the same Polygon contract to an operator cluster that distributes Vidar.
Named in this story
Companies
- CTM360
- published the report and said it analysed ClickFix activity
- Microsoft
- was cited as attributing 47% of Defender Experts initial-access cases in 2025 to ClickFix
- ESET
- was cited as measuring rises in ClickFix activity
- Cloudflare
- was impersonated by fake verification pages in the campaign sample
- Sekoia
- published a June 2026 analysis tying the same contract to a Vidar cluster
Organisations
- MITRE
- assigned the behaviour the sub-technique T1204.004 in March 2025
- Telegram
- provided channel descriptions used to resolve command-and-control infrastructure
Products and systems
- Polygon
- hosted the smart contract that returned lure hostnames
- Steam
- provided a profile page used to resolve command-and-control infrastructure
- WordPress
- was the delivery substrate in one analysed compromise
- Vidar Stealer
- was the payload reached in one analysed chain
- ErrTraffic framework
- was the framework Sekoia said used the Polygon contract
How the source tells it
The article is written as threat-intelligence promotion: urgent, insistent and self-authorising, with the authors turning their own report into the main proof.
- alarm loaded phrasing presents the technique as something ordinary defences cannot stop
- urgency claims about fast-rotating infrastructure and decaying controls push the reader towards immediate concern
- boosterism repeated self-reference to the authors’ own report and invitations to read it frame the piece as a product pitch