New Phishing Kit Automates ClickFix Attacks to Evade Security Defenses

A new phishing kit called the IUAM ClickFix Generator automates ClickFix attacks, enabling information stealers and remote access trojans to be deployed with relative ease, according to the report. It was first observed on 18 July 2025 and is hosted on an HTTP server at 38.242.212[.]5, remaining active into October 2025.

The kit is built with an Express.js backend and Tailwind CSS, imitates legitimate “Just a moment…” browser verification pages, and lets attackers tailor every element of the lure, including the page title, domain, messages, and prompts, with advanced options for JavaScript clipboard injection and OS detection.

When victims click the fake CAPTCHA, a payload is copied to the clipboard and the user is prompted to paste and run a command in a terminal, turning them into an unwitting participant; the clipboard contents can be customised for Windows or macOS. In campaigns observed, some variants delivered DeerStealer on Windows via a malicious MSI, while others targeted macOS with Odyssey and included multi‑platform payloads that depended on navigator.userAgent, with several domains hosting the pages.

Defences from Palo Alto Networks and the Unit 42 Incident Response team are urged, and users are warned never to trust browser verification prompts. According to Palo Alto Networks, vigilance and user education remain paramount in mitigating these phishing-as-a-service campaigns.