grep -rl "clickfix" ./articles
Google Threat Intelligence has documented the first nation-state use of EtherHiding: a DPRK group storing its downloader in smart contracts on two blockchains, updated for about a dollar a time. The coverage calls it takedown-proof. GTIG's own report points at the part that is not — the attackers do not run nodes, they call three API companies.
The 2026 Digital Defense Report, covering July 2025 to June 2026, says attackers are collecting the benefits of AI first. Underneath that headline are three numbers that do not need AI to explain them: nearly 40,000 CVEs in six months, a weaponisation median well below 24 hours against 30 to 60 days to remediate, and a 2020 vulnerability still responsible for most detections among the top five.
Huntress traced a remote access trojan back to a Custom GPT called Plus 5.6, hosted on OpenAI's own domain and reached through a sponsored Google result for the word chatgpt. The page it sent people to imitated a Cloudflare check and asked them to paste a line into PowerShell. OpenAI removed the GPT on 25 September; a replacement appeared on the 27th.
Netskope found over 5,400 compromised WordPress and PrestaShop sites pulling their next stage from smart contracts on the BNB Smart Chain testnet. EtherHiding is not new. Putting it on the testnet is, because the testnet costs nothing, behaves like the real chain, and has no abuse desk to write to.
Huntress found ScreenConnect clients that write a four-stage VBScript chain onto machines as they connect, profile each host, and then request a different payload depending on how much RAM it has and which EDR is installed. There is no code execution vulnerability to patch — it abuses file transfer, and ConnectWise says the fix is to turn the permission off.
TerminalFix is ClickFix with one substitution. A fake Cloudflare CAPTCHA asks you to paste a command, and instead of the Run dialog it sends you to Windows Terminal or PowerShell — where long multi-line scripts actually work. The end of the chain is a Python reverse tunnel that lets the operator reach anything your machine can see.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.