Meet IClickFix: a widespread framework using the ClickFix tactic

This report details the IClickFix campaign (active since late 2024), where attackers compromised over 3,800 WordPress sites to inject an obfuscated JavaScript framework that replaces pages with a ClickFix (fake CAPTCHA) lure; victims who execute the provided command download and run obfuscated PowerShell droppers that deploy NetSupport RAT (and previously Emmenhtal Loader/XFiles Stealer). The analysis includes infection chain stages, YARA rules, IoCs (domains, IPs, file hashes), evidence of YOURLS abused as a TDS, and recommendations for monitoring and mitigation.