ThreatPaper

#clickfix

3 cases

Rust maintainers targeted via fake-recruiter video calls — a supply-chain attack through the front door of trust

The Rust project warned that crate maintainers and rust-lang members are being lured into fake job/contract video calls, then pushed to install a bogus codec or paste a clipboard command — aiming to hijack accounts and publish malware. Tactics resemble DPRK 'contagious interview' campaigns.

Social EngineeringSupply Chain Attack
ChainScript RAT: a ClickFix-delivered trojan that hides its C2 pointer in a Polygon smart contract

Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.

MalwareSocial EngineeringCryptocurrency & Web3
Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware Across 100,000+ Sites

A hardcoded Cloudflare API key let attackers rewrite Brevo's web pages and the JavaScript widgets 100,000+ customer sites embed, serving a fake-CAPTCHA "ClickFix" clipboard-hijack lure and a password-bypassing WordPress backdoor for over five hours on September 14, 2026.

Supply Chain AttackMalwareSocial Engineering