ClickFix Phishing Campaign Targets Corporate Users with Malicious Download Links
What Happened – On 28 October 2026 the SANS Internet Storm Center reported a new phishing wave dubbed “ClickFix.” The campaign distributes short‑look‑alike emails that claim a critical software update is required. Each message contains a “ClickFix” button that redirects the recipient to a compromised domain hosting a PowerShell‑based downloader. The downloader fetches a second‑stage payload—typically a credential‑stealer or ransomware droplet—without user interaction. The campaign has been observed across multiple industries, with early indicators pointing to a focus on technology and financial services firms. The actors use fast‑flux DNS and URL‑shorteners to evade detection, and the malicious infrastructure appears to be refreshed weekly. SANS noted that the first‑stage payload is signed with a legitimate code‑signing certificate, further complicating automated blocking.
Why It Matters for Trust & Control Assurance – Phishing attacks test an organization’s identity‑and‑access controls and the effectiveness of its security‑awareness program, both core control objectives for audit readiness.
Who Is Affected – Technology SaaS providers, financial services firms, and any enterprise that relies on email for internal communications.
Recommended Actions – 1️⃣ Re‑evaluate phishing‑simulation cadence and incorporate “ClickFix”‑style lures. 2️⃣ Enforce MFA on all privileged accounts and privileged‑access workstations. 3️⃣ Deploy URL‑reputation filtering and sandboxing for inbound links. 4️⃣ Validate code‑signing certificates against an approved list. 5️⃣ Collect evidence of training completion and MFA enforcement for audit readiness. Source: SANS ISC – ClickFix Campaign
Technical Notes – Attack vector: phishing email with malicious link → PowerShell downloader → credential‑stealer/ransomware. Indicators: ‑ Subject lines containing “Critical Update – ClickFix”; ‑ URL patterns using bit.ly or tinyurl pointing to .clickfix[.]net; ‑ PowerShell command Invoke‑Expression (New-Object Net.WebClient).DownloadString(...). No CVE associated; the threat relies on social engineering. Source: [SANS ISC – Technical Details]*