The malicious technique known as ClickFix is being commoditized into easily accessible phishing kits, allowing a broader range of threat actors to utilize it effectively. This social engineering method manipulates users into bypassing security protocols by manually executing malware, which is typically designed for information theft and remote access control. The trend reflects the broader phenomenon of phishing-as-a-service, which reduces the technical expertise required for executing successful attacks. Recent investigations uncovered a phishing kit generator publicly accessible at IP address 38.242.212.5, first detected on July 18, 2025, and operating until early October. Attackers have leveraged this kit to create numerous phishing pages themed around ClickFix, which cleverly mimic browser verification challenges employed by CDN and web security platforms.