Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

Research shows the ClickFix paste-into-terminal social-engineering technique has evolved into an API-driven, on-demand payload service that returns uniquely obfuscated commands per visitor and now uses a Downloads-folder delivery to evade Windows script scanning (AMSI). The report documents scale and active use (ESET and Microsoft telemetry, large campaign counts), lists observed payload servers/domains, notes use by state-backed groups, and recommends defenders focus on process-chain signals (explorer/WindowsTerminal -> powershell/cmd/msiexec), behavioral EDR, application-control, and user education.