Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
ClickFix Campaign Generated Via AI Delivers SmartRAT
Malware Families
Excerpt
IntroductionIn March 2026, Zscaler ThreatLabz observed multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools. Threat actors are leveraging website builders to create convincing lures quickly and at scale, with capabilities ranging from basic credential theft to a ClickFix campaign that delivers remote access trojans (RATs).In this blog post, ThreatLabz examines a ClickFix campaign impersonating a Brazilian bank…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://64.95.13.238/payload.php | High | Score 58/100 | First seen |
| Domain | c.windowsupdate-cdn.com | High | Score 72/100 | First seen |
| IP | 162.141.111.227 | High | Score 72/100 | First seen |
| Domain | cartaobrb.com.br | High | Score 58/100 | First seen |
| Domain | cartaobb.com | High | Score 73/100 | First seen |
| URL | http://64.95.13.238/st.txt';iex(irm | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…