Minacce · 235 giorni fa
Campagne ClickFix e InstallFix istruiscono vittime ad aprire Windows Terminal e incollare comandi PowerShell. I comandi decodificati scaricano un 7‑Zip rinominato e estraggono payload che stabiliscono persistenza via scheduled tasks e configurano esclusioni in Microsoft Defender. La catena termina con esfiltrazione dati e il deployment di Lumma Stealer per rubare credenziali dei browser.
4 fonti che coprono questa storia
ClickFix Attack Uses Windows Terminal to Evade Detection
Fake CAPTCHA pages instruct victims to paste malicious commands in the Windows Terminal instead of the Run dialog.
ClickFix attackers using new tactic to evade detection, says Microsoft
Unwitting victims are now being tricked into installing malware via Windows Terminal, but some experts say this is old news.
Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer
Microsoft reveals ClickFix campaign abusing Windows Terminal to deliver Lumma Stealer and steal browser credentials.
Fake Claude Code install guides push infostealers in InstallFix attacks
Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users into running malicious commands under the pretext of installing legitimate command line interface (CLI) tools.
Riepilogo fornitore: Microsoft
Part of the PlainSec briefing for 2026-03-07