6 casos · pág. 1/1
Researchers at Vedere Labs (Forescout Research) reported on October 14 that they found ROMULUS, a new multi-payload shared ClickFix delivery platform, while investigating an incident. The same malware from a separate ClickFix campaign was linked to another server tied to that incident, and that server hosted the ROMULUS panel. ROMULUS is …
Episode 485 of the Smashing Security podcast, hosted by Graham Cluley with guest Lianne Potter, covers several security stories. Researchers who wanted to test LG smart TVs for security risks got around the terms and conditions by setting up the TV while drunk, on the reasoning that they could not be bound by a contract agreed to while in…
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). For…
Campaigns that impersonate popular AI brands, notably Claude and ChatGPT, are on the rise. They typically use ClickFix-like social engineering tactics to target unsuspecting enterprise employees, with developers described as being at particular risk. The article, available only as a short excerpt, gives no details on payloads, infrastruct…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
On October 20, 2026, Google announced new Chrome defenses for users of Safe Browsing Enhanced Protection. They include a warning against ClickFix social engineering, in which suspicious commands copied by the user are scrubbed of personal information and sent to Safe Browsing for analysis (thehackernews.com, gbhackers.com, securityweek.co…
