ClickFix and CORNFLAKE.V3: Mandiant Uncovers a New Wave of Access-as-a-Service Campaigns

Mandiant attributes a coordinated cybercrime campaign to UNC5518 that weaponizes compromised websites with fake CAPTCHA “ClickFix” lures to trick victims into running downloader commands; this enables deployment of the CORNFLAKE.V3 backdoor (Node.js and PHP variants) and other payloads by partnering groups, with capabilities including persistence, multi-format payload execution, reconnaissance, Kerberoasting for credential theft, and use of access-as-a-service to monetize footholds.