News

Microsoft has published new findings about an evolved ClickFix social-engineering trick in which victims are persuaded to run a command that performs a DNS lookup to fetch the next-stage payload. The abuse centers on the Windows nslookup utility and the Run dialog to kick off a custom name resolution that delivers malicious instructions.

According to the Microsoft Threat Intelligence team, the attack launches a command through cmd.exe that invokes nslookup against an externally specified DNS server hard-coded into the command rather than the machine’s configured resolver. The returned DNS response is parsed to capture the line labeled “Name:”, and that extracted content is then treated as the second-stage payload and executed. Microsoft describes this approach as using DNS as a lightweight staging or signaling channel that lets operators contact infrastructure they control and build an extra validation step before running the follow-up code.

Microsoft also noted that using DNS for this purpose can reduce reliance on ordinary web requests and help malicious traffic blend in with legitimate network activity, making detection harder for defenders.

In the observed chain, the staged payload downloads a ZIP archive from an external host (azwsappdev[.]com). That archive contains a Python script which, once extracted and executed, performs reconnaissance and discovery commands and drops a Visual Basic Script (VBScript) that ultimately launches ModeloRAT - a Python-based remote access trojan previously tied to CrashFix campaigns.

To keep foothold after reboot, the attack creates a Windows shortcut (LNK) in the Startup folder that points to the VBScript, ensuring the malware executes each time the OS starts.

Separately, Bitdefender has sounded the alarm about a spike in Lumma Stealer activity that is being pushed via ClickFix-style fake CAPTCHA pages. Those campaigns deliver an AutoIt variant of CastleLoader, a loader associated with an actor tracked as GrayBravo (formerly TAG-150). CastleLoader performs environment checks for virtualization and particular security products before decrypting and launching the stealer in memory, and operators also use lure pages offering cracked software or pirated films to trick users into running malicious installers or files masquerading as MP4s.

Other CastleLoader chains have begun from sites advertising pirated apps, which lead victims to a bogus NSIS installer. That installer executes obfuscated VBA scripts before the AutoIt component launches Lumma Stealer; the VBA stage is also used to register scheduled tasks that provide persistence.

Bitdefender noted that despite significant law-enforcement disruption in 2025, Lumma Stealer operations proved resilient, quickly moving to new hosting providers and experimenting with alternative loaders and delivery techniques. CastleLoader remains central to many of these distribution chains. One domain tied to CastleLoader infrastructure - testdomain123123[.]shop - was flagged as a Lumma Stealer command-and-control host, suggesting either collaboration or shared service providers between the two groups. The bulk of Lumma Stealer infections have been observed in India, followed by France, the U.S., Spain, Germany, Brazil, Mexico, Romania, Italy and Canada.

Bitdefender emphasized that ClickFix succeeds by exploiting users’ trust in procedural instructions rather than leveraging a software vulnerability. The guidance given in these scams looks like routine troubleshooting or verification steps, so victims may unknowingly run arbitrary commands on their machines.

CastleLoader is not the sole loader used to distribute Lumma Stealer. Since March 2025, some campaigns have used a loader called RenEngine Loader. Those operations typically masquerade as game cheats or pirated applications such as CorelDRAW, with RenEngine handing off to a secondary component named Hijack Loader, which then deploys Lumma Stealer. Kaspersky telemetry shows RenEngine incidents affecting users primarily in Russia, Brazil, Turkey, Spain, Germany, Mexico, Algeria, Egypt, Italy and France since March 2025.

These developments arrive amid a wide range of campaigns that employ ClickFix-style social engineering to deliver stealers and loaders across Windows and macOS.

For macOS, researchers have tracked campaigns pushing Odyssey Stealer - a rebrand of Poseidon Stealer that itself forked from Atomic macOS Stealer (AMOS). Odyssey exfiltrates credentials and data from 203 browser wallet extensions and 18 desktop wallet applications to facilitate crypto theft. Censys notes that Odyssey also functions as a full-featured remote access trojan: a persistent LaunchDaemon polls the command-and-control every 60 seconds for instructions, enabling arbitrary shell execution, reinfection, and even a SOCKS5 proxy for routing traffic through compromised Macs.

On Windows, ClickFix chains continue to use fake CAPTCHA pages on compromised but legitimate sites to trick users into running PowerShell commands that install the StealC information stealer. Another phishing variant delivers a malicious SVG inside a password-protected ZIP archive and instructs victims-via ClickFix-style steps-to run a PowerShell one-liner that ultimately drops Stealerium, an open-source .NET infostealer.

Attackers have also weaponized the public-sharing features of generative AI services like Anthropic’s Claude to host ClickFix-style instructions (for example, “online DNS resolver” tips) and then amplify those links through sponsored search results on engines such as Google to push Atomic Stealer and MacSync Stealer.

One takedown-resistant campaign dupes people searching for “macOS cli disk space analyzer” into a forged Medium post impersonating Apple Support and persuades them to execute ClickFix instructions that pull a stealer from raxelpak[.]com. MacPaw’s Moonlock Lab observed that the raxelpak domain has a URL history stretching back to 2021 when it hosted a safety workwear e-commerce site; whether the domain was hijacked or allowed to expire and then re-registered is uncertain, but using aged domains with preexisting reputation is a recurring evasion tactic.

A related variation stages ClickFix steps to “install Homebrew” via links surfaced in sponsored Claude and Evernote results, again leading to stealer installation. AdGuard warned that the combination of Google Ads, a legitimate well-known platform (in this case claude.ai), and technically proficient users creates an effective malware distribution vector: clicking the ad lands on a real Claude page, not a cloned phishing site, yet the result still funnels victims toward malicious instructions.

Mac-focused email campaigns have also been noted that ask recipients to run an AppleScript to “fix compatibility issues.” Those scripts then drop follow-up AppleScripts and JavaScript payloads designed to steal credentials. Darktrace found that some macOS malware avoids direct permission prompts by forging Transparency, Consent, and Control (TCC) authorizations for trusted, Apple-signed binaries such as Terminal, osascript, Script Editor and bash, and then executes malicious actions through those binaries to inherit their permissions.

Another strain, dubbed ClearFake, uses counterfeit CAPTCHA prompts on compromised WordPress sites to trigger an HTML Application (HTA) that deploys Lumma Stealer. These campaigns have also been observed injecting malicious JavaScript that leverages a technique called EtherHiding to call a contract on the BNB Smart Chain and retrieve an external payload hosted on GitHub. Attackers favor this approach because blockchain-based components can make malicious activity appear like legitimate Web3 traffic and are more resilient to takedown attempts due to their decentralized nature.

Flare’s recent analysis highlights a broader trend of increasing focus on macOS by actors deploying infostealers and sophisticated toolsets. The company points out that macOS stealers are overwhelmingly focused on cryptocurrency theft: Macs are disproportionately used by cryptocurrency holders, those users often keep funds in software wallets, and crypto transfers are irreversible. As a result, once seed phrases are exfiltrated, victims typically have no recourse.

Flare urged organizations with Mac users to adopt macOS-specific detection capabilities, looking for signs such as unsigned apps requesting passwords, unusual Terminal activity, connections to blockchain nodes that have no business purpose, and exfiltration patterns targeting Keychain and browser-stored credentials.