Hudson Rock Adds ClickFix Monitoring and Other Threat Feeds to Cavalier
Summary
Hudson Rock says Cavalier’s new C2, ClickFix, and phishing-as-a-service feeds help teams monitor malicious infrastructure, inspect ClickFix payloads, and identify infostealer-linked credentials associated with compromised sites.
Key points
- The announced Cavalier modules cover infostealer command-and-control data, ClickFix activity, and phishing-as-a-service.
- The ClickFix monitor surfaces flagged sites, clipboard-injection and CAPTCHA indicators, copied commands, screenshots, domains, and URLs.
- The article says infostealer credential telemetry can reveal credentials associated with compromised sites and their use in gaining access.
- A described Artlist case links a developer’s infostealer infection to exposed WordPress credentials and a compromised subdomain serving a ClickFix payload.
- ClickFix feed data is available through REST API endpoints for retrieving detected sites and looking up specific domain records.
- Hudson Rock says teams can feed indicators into perimeter controls, firewalls, and DNS sinks to block malicious sites.
Article Details
- Event Type
- Launch of Cavalier threat-feed modules for C2, ClickFix, and PhaaS monitoring, with an example of a compromised Artlist subdomain used to deliver a ClickFix payload.
- Impact
- The feeds let security teams monitor flagged ClickFix sites, domains, URLs, clipboard activity, and related evidence, and retrieve indicators through REST API endpoints for defensive controls. The article says stolen WordPress credentials enabled attackers to compromise an Artlist subdomain and inject an EtherHiding script that routed visitors to a ClickFix payload.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | solaric[.]com[.]ph | The article identifies this compromised business domain as hacked and weaponized to host ClickFix activity. |
Vendors
Products
Adobe Acrobat PRO DCA freelance developer unwittingly downloaded a pirated copy of Adobe Acrobat PRO DC, infecting their machine.CavalierIntroducing Cavalier’s New Threat Feeds: Deep Dive into ClickFix MonitoringWordPressHudson Rock cybercrime intelligence revealing infostealer credentials associated with solaric.com.ph’s WordPress admin panel.