SecuriTricks - deerstealer

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

The ClickFix campaign has evolved from basic disk-based infections to sophisticated, obfuscated attacks using fake CAPTCHA pages that trick victims into executing malicious PowerShell commands. Initial variants used cleartext commands downloading batch scripts to deploy DeerStealer InfoStealer. The…

powershell

infostealer

server-side polymorphism

Published: May 20, 2026

Downloadable IOCs: 605

The ClickFix Factory: First Exposure of IUAM ClickFix Generator

Palo Alto Unit42 have uncovered a phishing kit named the IUAM ClickFix Generator that automates the creation of these attacks. The kit is designed to generate highly customizable phishing pages that lure victims by mimicking browser verification challenges often used to block automated traffic. It …

Published: October 10, 2025

Downloadable IOCs: 59

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

DeerStealer is a sophisticated information-stealing malware that targets a wide range of user and system data. It employs deception techniques, persistence mechanisms, and rootkit-like capabilities to evade detection and maintain stealth on compromised systems. The malware uses signed executables, …

multi-stage-execution

xfiles spyware

Published: September 20, 2025

Downloadable IOCs: 0

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It em…

Published: September 12, 2025

Downloadable IOCs: 14

Tag: deerstealer

Attack reports

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

The ClickFix Factory: First Exposure of IUAM ClickFix Generator

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

CastleLoader Analysis

An Update on Fake Updates: Two New Actors, and New Mac Malware

Brief Overview of the DeerStealer Distribution Campaign

Threat actor impersonates Google via fake ad for Authenticator