Insikt Group Details Five ClickFix Campaign Clusters Targeting Windows and macOS

Mar 25, 2026 · Original article ↗

Summary

Insikt Group analyzed five ClickFix clusters that trick users into running obfuscated commands in Windows or macOS tools. The campaigns delivered RATs and information stealers; the report details their execution chains and recommends hardening native utilities.

Key points

Insikt Group tracked five clusters active since at least May 2024, using fake verification prompts and lures impersonating services including QuickBooks, Booking.com, and Birdeye.
ClickFix shifts execution to user-assisted commands in trusted tools such as Windows Run, PowerShell, and macOS Terminal, bypassing browser-based defenses.
The observed chain commonly involves obfuscated input, native execution, payload retrieval from actor infrastructure, and in-memory execution.
Observed payloads included NetSupport RAT, MacSync, Lumma Stealer, Vidar, and Odyssey Stealer; some Windows chains established persistence through Startup shortcuts.
The researchers identified clusters by analyzing HTML artifacts such as DOM hashes, image tags, and page titles, and observed disposable infrastructure, often behind Cloudflare.
Recommended defenses include disabling the Windows Run dialog, restricting PowerShell and macOS shell access, and using application controls and user training.

Article Details

Attack Vectors: Fraudulent human-verification pages use pastejacking or directed copy-and-paste instructions to trick users into running obfuscated commands in Windows Run or PowerShell, or macOS Terminal.
PowerShell and shell stagers retrieve scripts and payloads from threat-actor infrastructure, including commands that pipe downloaded content to an interpreter for in-memory execution.
Living-off-the-land utilities, including 7z.exe, are used to extract staged payloads; Startup-folder shortcuts establish persistence for NetSupport RAT.
Some campaigns detect the operating system and tailor lures and commands for Windows or macOS.
Defensive Notes: Disable the Windows Run dialog and its Win+R shortcut through Group Policy Objects.
Use PowerShell Constrained Language Mode and AppLocker or Windows Defender Application Control to restrict scripts and misuse of living-off-the-land binaries.
Restrict Terminal and shell interpreters such as zsh and bash on macOS through mobile device management policies; use System Integrity Protection and endpoint controls to limit unauthorized script execution.
Monitor for brand impersonation and distinctive HTML artifacts, and update SIEM and EDR controls with identified malicious infrastructure risk lists.
Train users not to copy and run commands prompted by manual verification challenges.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`alababababa[.]cloud`	Malicious ClickFix payload host associated with delivery of multiple malware strains.
DOMAIN	`bkng-updt[.]com`	Dropper domain hard-coded in the malicious command associated with sign-in-op-token[.]com.
DOMAIN	`checkpulses[.]com`	Malicious staging server used to deliver files in the Booking.com-themed ClickFix campaign.
DOMAIN	`chrm-srv[.]com`	NetSupport RAT C2 domain contacted after infection in the Booking.com campaign.
DOMAIN	`gologpoint[.]com`	NetSupport RAT C2 domain contacted by neservice.exe.
DOMAIN	`hotelupdatesys[.]com`	Booking.com campaign domain associated with an IP address identified as NetSupport RAT C2 infrastructure.
DOMAIN	`joeyapple[.]com`	C2 server identified for the macOS Storage Cleaning campaign associated with MacSync.
DOMAIN	`mac-os-helper[.]com`	Domain shown as a landing page for the Dual-Platform Selection ClickFix campaign.
DOMAIN	`macosapp-apple[.]com`	ClickFix page domain used in the Dual-Platform Selection campaign.
DOMAIN	`ms-scedg[.]com`	NetSupport RAT C2 domain identified in the Booking.com campaign.
DOMAIN	`nobovcs[.]com`	Threat-actor payload host used to retrieve PowerShell staging scripts and files for the NetSupport RAT infection chain.
DOMAIN	`octopox[.]com`	C2 server identified for the macOS Storage Cleaning campaign associated with MacSync.
DOMAIN	`sign-in-op-token[.]com`	Fraudulent Booking.com-themed ClickFix domain associated with a NetSupport RAT infection chain.
DOMAIN	`thestayreserve[.]com`	ClickFix campaign domain whose scripts retrieved staging files from checkpulses[.]com.
IPV4	`152[.]89[.]244[.]70`	IP address identified as NetSupport RAT C2 infrastructure and as the resolution address for chrm-srv[.]com and ms-scedg[.]com.
IPV4	`45[.]144[.]233[.]192`	IP address hosting the macosapp-apple[.]com ClickFix page.
IPV4	`62[.]164[.]177[.]230`	IP address to which the article says gologpoint[.]com resolves; associated with NetSupport RAT C2.
IPV4	`77[.]91[.]65[.]144`	IP address listed as NetSupport RAT C2 infrastructure in the Booking.com campaign.
IPV4	`77[.]91[.]65[.]31`	IP address listed as NetSupport RAT C2 infrastructure in the Booking.com infection chain.
IPV4	`91[.]202[.]233[.]206`	IP address listed for the malicious sign-in-op-token[.]com ClickFix domain.
SHA256	`397dcea810f733494dbe307c91286d08f87f64aebbee787706fe6561ed3e20f8`	SHA-256 listed for a staging artifact downloaded from the malicious checkpulses[.]com server.
SHA256	`5d821db386c7c879caeabf3e9f94c94a48eec6ec5a3a0efbae9d69da3f52c1db`	SHA-256 of lnk.7z, a staged archive used to place a shortcut in the Startup folder for persistence.
SHA256	`c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50`	SHA-256 of at.7z, a staged archive downloaded from nobovcs[.]com that contains the NetSupport RAT binary.
URL	`hxxps[:]//alababababa[.]cloud/cVGvQio6[.]txt`	Specific malicious payload URL that the Birdeye-themed ClickFix command directs victims' devices to reach.