Connect with us

Tech

ClickFix attacks that bypass cyber controls on the rise | Computer Weekly

Published

on

ClickFix attacks that bypass cyber controls on the rise | Computer Weekly


So-called ClickFix or ClearFake attacks that bypass security controls and use unwitting victims to execute a cyber attack of their own accord are surging at the end of 2025, even outpacing phishing or clickjacking attacks, according to NCC Group’s latest monthly threat report.

First identified a couple of years ago, ClickFix attacks flooded the threat landscape during 2024, and their volume surged by over 500% in the first six months of 2025, said NCC.

Rather than relying on automated exploits or malicious attachments, ClickFix attacks exploit human fallibility by convincing their targets to manually execute attacks using tools like PowerShell, Windows Run box, or other shell utilities after luring them to compromised websites promising fake prompts that instruct them to copy a command into their Run dialogue or PowerShell window.

NCC said such attacks represent a marked shift in social engineering because the victims are acting entirely voluntarily – this is in contrast to phishing attacks in which the deception ends once credentials have been submitted, or clickjacking, where victims unknowingly engage.

“This shift challenges traditional detection models as the command originates from a trusted user process, rather than an untrusted download or exploit chain,” wrote the NCC team.

“Understanding and mitigating ClickFix attacks is crucial because it can bypass conventional defences,” they said. “Email filters, sandboxing and automated URL analysers cannot always flag a malicious action that is conducted manually by an end user. Once the payload is executed, attackers can deploy RATs, enabling persistence, credential harvesting and eventual ransomware deployment.”

Financially motivated cyber criminals have been quick to climb on board the ClickFix wagon, many of them operating in larger access broker ecosystems to sell on compromised endpoints to ransomware gangs.

The report details a number of such targeted ClickFix operations. One campaign, active from April 2025 until just a couple of months ago, targeted the hospitality sector and duped employees into spreading infostealer malware across multiple hotel chains. This campaign used the PureRAT remote access trojan (RAT) to steal the hotels’ Booking.com credentials and conduct downstream email and WhatsApp phishing attacks against guests.

Another campaign, run by Kimsuky, a North Korean state threat actor, prompted its victims to copy and paste bogus authentication codes into PowerShell after posing as a US national security aide trying to set up meetings on South Korean issues.

Defending against ClickFix attacks is largely a matter of attempting to cut down on an organisation’s exposure to malicious lures and deceptive landing sites by incorporating tools such as URL filtering, domain reputation controls, web-filtering and sandboxing. Tightening endpoint execution environments is also a must, as is strengthening user awareness and instructing all employees to treat any unsolicited copy-paste instruction as an attempted cyber attack.

Ransomware stats

The growth in ClickFix attacks came amid a plateauing of general cyber attack volumes during the past few weeks, with tracked ransomware hits falling 2% in November, NCC found.

The Qilin operation held firm as the most active gang observed in NCC’s telemetry, accounting for 101 attacks, followed by Cl0p with 98, Akira with 81, and INC Ransom with 49.

Additionally notable in November was the DragonForce gang – NCC attributed 19 attacks to it during the period, although it has claimed many more itself – which became one of the more prominent active cyber gangs this year thanks to its reliance on collaboration with highly skilled affiliates, among them Scattered Spider, the hacking collective that hit Marks & Spencer, among many others.

Although collaboration between threat actors is nothing new, NCC said that DragonForce’s activity showed how gangs can maximise such strategies to strengthen their capabilities.

This said, at the same time, DragonForce has also taken something of a sledgehammer to the concept of honour among thieves. In May, it was observed hacking and defacing the data leak sites of rival gangs, and at one point initiated a hostile takeover bid of the RansomHub crew.

NCC said this competitiveness may reflect the lowering of technical barriers to participation in the cyber criminal ecosystem. Attacking competitors, it suggested, may form part of a deterrence strategy to keep newcomers from establishing themselves.

Don’t be complacent

“Business leaders cannot afford to become complacent,” said Matt Hull, NCC global head of threat intel. “Threat groups are rapidly evolving, sharing tools and techniques, and already exploiting the festive period, when vigilance often drops.

“With the new Cyber Security and Resilience Bill and high-profile breaches at M&S, Co-op and JLR [Jaguar Land Rover] this year, organisations are under growing scrutiny to prove they have robust defences and incident response plans in place,” he added.

“As the holidays approach, staying alert to suspicious activity and strengthening security posture is as important as ever.”



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

How Trump’s Plot to Grab Iran’s Nuclear Fuel Would Actually Work

Published

on

How Trump’s Plot to Grab Iran’s Nuclear Fuel Would Actually Work


President Donald Trump and top defense officials are reportedly weighing whether to send ground troops to Iran in order to retrieve the country’s highly enriched uranium. However, the administration has shared little information about which troops would be deployed, how they would retrieve the nuclear material, or where the material would go next.

“People are going to have to go and get it,” secretary of state Marco Rubio said at a congressional briefing earlier this month, referring to the possible operation.

There are some indications that an operation is close on the horizon. On Tuesday, The Wall Street Journal reported that the Pentagon has imminent plans to deploy 3,000 brigade combat troops to the Middle East. (At the time of writing, the order has not been made.) The troops would come from the Army’s 82nd Airborne Division, which specializes in “joint forcible entry operations.” On Wednesday, Iran’s government rejected Trump’s 15-point plan to end the war, and White House press secretary Karoline Leavitt said that the president “is prepared to unleash hell” in Iran if a peace deal is not reached—a plan some lawmakers have reportedly expressed concern about.

Drawing from publicly available intelligence and their own experience, two experts outlined the likely contours of a ground operation targeting nuclear sites. They tell WIRED that any version of a ground operation would be incredibly complicated and pose a huge risk to the lives of American troops.

“I personally think a ground operation using special forces supported by a larger force is extremely, extremely risky and ultimately infeasible,” Spencer Faragasso, a senior research fellow at the Institute for Science and International Security, tells WIRED.

Nuclear Ambitions

Any version of the operation would likely take several weeks and involve simultaneous actions at multiple target locations that aren’t in close proximity to each other, the experts say. Jonathan Hackett, a former operations specialist for the Marines and the Defense Intelligence Agency, tells WIRED that as many as 10 locations could be targeted: the Isfahan, Arak, and Darkhovin research reactors; the Natanz, Fordow, and Parchin enrichment facilities; the Saghand, Chine, and Yazd mines; and the Bushehr power plant.

According to the International Atomic Energy Agency, Isfahan likely has the majority of the country’s 60 percent highly enriched uranium, which may be able to support a self-sustaining nuclear chain reaction, though weapon-grade material generally consists of 90 percent enriched uranium. Hackett says that the other two enrichment facilities may also have 60 percent highly enriched uranium, and that the power plant and all three research reactors may have 20 percent enriched uranium. Faragasso emphasizes that any such supplies deserve careful attention.

Hackett says that eight of the 10 sites—with the exception of Isfahan, which is likely intact underground, and “Pickaxe Mountain,” a relatively new enrichment facility near Natanz—were mostly or partially buried after last June’s air raids. Just before the war, Faragasso says, Iran backfilled the tunnel entrances to the Isfahan facility with dirt.

The riskiest version of a ground operation would involve American troops physically retrieving nuclear material. Hackett says that this material would be stored in the form of uranium hexafluoride gas inside “large cement vats.” Faragasso adds that it’s unclear how many of these vats may have been broken or damaged. At damaged sites, troops would have to bring excavators and heavy equipment capable of moving immense amounts of dirt to retrieve them

A comparatively less risky version of the operation would still necessitate ground troops, according to Hackett. However, it would primarily use air strikes to entomb nuclear material inside of their facilities. Ensuring that nuclear material is inaccessible in the short to medium term, Faragasso says, would entail destroying the entrances to underground facilities and ideally collapsing the facilities’ underground roofs.

Softening the Area

Hackett tells WIRED that based on his experience and all publicly available information, Trump’s negotiations with Iran are “probably a ruse” that buys time to move troops into place.

Hackett says that an operation would most likely begin with aerial bombardments in the areas surrounding the target sites. These bombers, he says, would likely be from the 82nd Airborne Division or the 11th or 31st Marine Expeditionary Units (MEU). The 11th MEU, a “rapid-response” force, and the 31st MEU, the only Marine unit continuously deployed abroad in strategic areas, have reportedly both been deployed to the Middle East.



Source link

Continue Reading

Tech

Amazon’s Spring Sale Is So-So, but Cadence Capsules Are a Bright Spot

Published

on

Amazon’s Spring Sale Is So-So, but Cadence Capsules Are a Bright Spot


The WIRED Reviews Team has been covering Amazon’s Big Spring Sale since it began at on Wednesday, and the overall deals have been … not great, honestly. So far, we’ve found decent markdowns on vacuums, smart bird feeders, and even an air fryer we love, but I just saw that Cadence Capsules, those colorful magnetic containers you may have seen on your social media pages, are 20 percent off. (For reference, the last time I saw them on sale, they were a measly 9 percent off.)

If you’re not familiar, they allow you to decant your full-sized personal care products you use at home—from shampoo and sunscreen to serums and pills—into a labeled, modular system of hexagonal containers that are leak-proof, dishwasher safe, and stick together magnetically in your bag or on a countertop. No more jumbled, travel-sized toiletries and leaky, mismatched bottles and tubes.

Cadence Capsules have garnered some grumbling online for being overly heavy or leaking, but I’ve been using them regularly for about a year—I discuss decanting your daily-use products in my guide to How to Pack Your Beauty Routine for Travel—and haven’t experienced any leaks. They do add weight if you’re trying to travel super-light, and because they’re magnetic, they will also stick to other metal items in your toiletry bag, like bobby pins or other hair accessories. This can be annoying, especially if you’re already feeling chaotic or in a hurry.

Otherwise, Capsules are modular, convenient, and make you feel supremely organized—magnetic, interchangeable inserts for the lids come with permanent labels like “shampoo,” “conditioner,” “cleanser,” and “moisturizer.” Maybe you love this; maybe you don’t. But at least if you buy on Amazon, you can choose which label genre you get (Haircare, Bodycare, Skincare, Daily Routine). If this just isn’t your jam, the Cadence website offers a set of seven that allows you to customize the color and lid label of each Capsule, but that set is not currently on sale.



Source link

Continue Reading

Tech

Fellow Readers, Don’t Miss These E-Reader Sales

Published

on

Fellow Readers, Don’t Miss These E-Reader Sales


This is the older Kindle Scribe, but the price and features are the best you’ll get, especially when it’s on sale like this. I still reach for this model even though I have the newer third generation, and keep in mind the second generation will also get some of the newer software and experiences over time. With the sale, it’s half the price of the newer model.

Amazon

Kindle Colorsoft and Colorsoft Signature Edition

If you’re already a Kindle reader and looking to upgrade, it’s likely because you want a new feature like a color screen. While the Kobo above is the better buy, if you want to stay in the Kindle ecosystem but add some color to your books, both the Colorsoft and Colorsoft Signature are on sale.

Amazon

Kindle (2024, 11th Gen)

If you’re looking to spend as little as possible, the basic Kindle (11th generation) is still a great e-reader and is currently under $100. It can do almost everything the other Kindles can (except the Scribe) on a snappy black-and-white screen. It doesn’t have a warm front light either, but it’s still a great purchase for the price.


Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.



Source link

Continue Reading

Trending