Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Cato CTRL Insights: When Trust Becomes the Payload in a Fake Codex ClickFix Campaign
Excerpt
Executive Summary Attackers are using a fake Codex download experience to trick macOS users into pasting a malicious command into Terminal. This technique, known as ClickFix, relies on social engineering rather than a conventional malware download: the victim is persuaded to perform the execution step themselves. We analyzed sponsored search results leading to convincing Google Sites pages, a no-code website-building and hosting service provided by Google. An…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | e4e078458c025e0905d94f6d9a93439024e8f256b068d8e67da7f34ba1c93d27 | Medium | Score 53/100 | First seen |
| SHA256 | 9c3a28c5b8b9ced508786aad723efb8105b9d20f61095b28556c3d89a5c00343 | Medium | Score 53/100 | First seen |
| SHA256 | 48db5d715c583b4495ee1e3095f097ed9bc04625e4516e1fa437fcb374fec249 | Medium | Score 53/100 | First seen |
| Domain | bright-links.com | High | Score 61/100 | First seen |
| SHA256 | 1f252b86edddda142a69cf9059b67a4aa842f7fd8aedbfdd6937850138e3a63e | Medium | Score 53/100 | First seen |
| Domain | parentpreneurx.com | High | Score 58/100 | First seen |
| SHA256 | ad4e26afb47dc6262d43b5616853349c3bbdab5c8eedac80f695151e00c07df8 | Medium | Score 53/100 | First seen |
| SHA256 | fcb74c3c5134a97b5bc90b2e0bad67a8e3044f769f844313e21069c7480d97cd | Medium | Score 53/100 | First seen |
| SHA256 | 95d5ae5e87b4eae733655f6fc7bfdeb1efbc618d95375a46f6f8d353b48426dc | Medium | Score 53/100 | First seen |
| SHA256 | 684d4875a60e832c6993bb08bf0ec4fbd7ca89c1a44ba1ab65fac6d9fb202599 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…