ClickFix Phishing: New Automated Kits Trick Users Into Manually Running Malware and Stealers

Researchers from Palo Alto Networks Unit 42 have uncovered a commoditized phishing ecosystem built around an automated tool called the IUAM ClickFix Generator, which lets threat actors of any skill level create realistic pages that mimic browser verification challenges. According to Unit 42, attackers are packaging this social engineering technique into easy-to-use phishing kits to bypass security by having victims manually execute malware, typically information stealers and remote access Trojans.

The kits automate page creation and payload delivery, and a campaign observed from July through October 2025 used a server hosted at an IP address 38.242.212[.]5 to support its web interface. In one Windows-only campaign, a victim’s interaction copies a malicious PowerShell command to the clipboard and instructs them to paste it into the Run dialog to download and install DeerStealer.

A separate macOS-focused series delivered Odyssey Infostealer, with payloads chosen via JavaScript that detects the victim’s OS and uses Base64-encoded commands executed by nohup bash to ensure persistence.