New Phishing Kit Automates Generation of ClickFix Attack Bypassing Security Measures

The cybersecurity sector has identified a new phishing toolkit known as the IUAM ClickFix Generator. This toolkit automates the creation of "ClickFix" attack pages, allowing individuals with limited technical skills to deploy advanced social engineering attacks.

The IUAM ClickFix Generator centralizes all necessary configuration options—such as page title, domain, verification prompts, and clipboard instructions—into a web-based interface. This results in an efficient solution for creating malicious pages that mimic legitimate browser verification processes, thereby tricking victims into executing commands that install malware.

First observed in early July 2025, the ClickFix Generator appeared on underground forums offering phishing-as-a-service subscriptions. Attackers utilize compromised domains to host these tools, injecting obfuscated JavaScript into existing websites to seamlessly render phishing overlays. These phishing pages often mimic Cloudflare-style verification checks, misleading users into copying and pasting commands into their system consoles.

This method of social engineering leverages manual user actions as the primary vector for infection, bypassing network and endpoint security controls. Analysts at Palo Alto Networks have observed that despite cosmetic differences across various domains, all phishing pages maintain a nearly identical HTML structure and JavaScript event handlers that intercept click events to copy malicious commands into the victim's clipboard.

Several variants include basic operating system detection logic—using the navigator.userAgent—to provide tailored instructions for Windows or macOS hosts, while others present uniform instructions effective on any desktop platform. Real-world campaigns have deployed DeerStealer on Windows systems and Odyssey on macOS through Base64-encoded shell commands.

The operational impact of these campaigns is significant. By requiring users to manually execute commands, attackers circumvent content inspection engines and browser sandboxes that typically block automated payload downloads. Organizations have reported multiple incidents where victims inadvertently executed multi-stage scripts, resulting in credential theft and persistent backdoor installations.

The IUAM ClickFix Generator reduces the barrier to entry for launching targeted phishing campaigns, thereby increasing the number of actors capable of attacking enterprises and public sector targets.

The ClickFix pages utilize a lightweight JavaScript snippet that binds a click handler to a fake CAPTCHA checkbox. When clicked, this handler executes code that writes a malicious command to the clipboard and guides the user through a series of keystrokes to execute it. This approach bypasses browser security warnings and content filtering, making detection by endpoint protection platforms difficult.

Ongoing updates to the toolkit have introduced additional evasion techniques, such as dynamic generation of clipboard commands, suppression of popover overlays upon failed execution attempts, and multi-domain load balancing to distribute hosting across compromised sites.

As the IUAM ClickFix Generator continues to evolve, it is imperative for defenders to prioritize user education and implement strict command-execution policies at the endpoint level to mitigate this emerging threat.

Based on reporting by Cyber Security News.