“ClickFix” Trap: Fake Human Verification Leads to Qilin Ransomware Infection

A deception tactic known as “ClickFix” has become a gateway for large-scale ransomware campaigns, with researchers linking fake human verification prompts directly to the Qilin ransomware group.

According to Counter Threat Unit (CTU) research, a compromised legitimate site served a heavily obfuscated script that fingerprinted the user and produced a fake ClickFix verification page; victims who clicked through unknowingly downloaded a batch file that installed NetSupport Manager, a legitimate remote administration tool often abused by attackers.

The RAT then connected to a command-and-control server and fetched a ZIP containing a legitimate Microsoft executable (mfpmp.exe) used to sideload a malicious DLL, triggering StealC V2, an info-stealer released in March 2025, with upgrades noted as making it more stealthy.

Using credentials likely harvested by StealC, threat actors later accessed the victim network via a Fortinet VPN account, after which Qilin ransomware notes appeared across the network; the operation is led by the GOLD FEATHER group and described as the most prevalent ransomware-as-a-service operation between January 2024 and 17 December 2025, with 1,168 victims in that period.

The CTU team emphasises patching vulnerable internet-facing devices and restricting exposed services, while urging robust phishing-resistant multi-factor authentication to block initial access brokers.