The ClickFix Factory: First Exposure of IUAM ClickFix Generator

Unit 42’s analysis reveals a first exposure of the IUAM ClickFix Generator, a phishing-kit builder that enables threat actors to produce highly customisable pages that mimic browser verification challenges. The publicly exposed generator was first observed on 18 July 2025 at an HTTP server hosting an application on TCP port 3000, with content used to create pages that copy malicious commands to victims’ clipboards and prompt manual execution.

Campaigns have included DeerStealer delivered via a Windows-focused variant and Odyssey-infostealer deployments for macOS, with several multi‑platform variations that tailor commands according to the victim’s OS. The pages are noted to employ OS detection through JavaScript and to include Base64-encoded commands or PowerShell instructions, sometimes accompanied by misleading decoys for unknown systems.

The article, published on 8 October 2025, also identifies a broader ecosystem around ClickFix-style pages, including several domains and IPs associated with Odyssey and DeerStealer C2 infrastructure. Palo Alto Networks recommends their Advanced URL Filtering, Advanced DNS Security, and WildFire analyses to help detect and block these malicious pages.