Qakbot Resurfaces in Fresh Wave of ClickFix Attacks

Buguard researchers observed a cross‑border campaign (late 2024–early 2025) using fake CAPTCHA pages (the ClickFix technique) posted on LinkedIn and other social media to trick victims into pasting PowerShell commands; those flows lead to PHP droppers that download and execute Qakbot and other payloads (infostealers, ransomware). The activity affected multiple industries and countries, and some malicious domains (e.g., duolingos.com, cfcaptcha.com) hosting the dropper were removed as part of mitigation efforts.