← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic
In November 2025, threat analysts from Sekoia TDR discovered a malware distribution campaign targeting WordPress websites using a social engineering tactic known as ClickFix, facilitated through a Traffic Distribution System (TDS). This campaign primarily employed watering hole attacks, wherein legitimate websites are compromised to lure victims into executing malicious commands.
Sekoia TDR implemented an advanced detection capability to identify these watering hole attacks, utilizing generic YARA rules to scan for compromised web pages featuring the ClickFix tactic. These rules are based on specific keywords, resource patterns, and JavaScript functions associated with the tactic's implementation.
MITRE ATT&CK & Malware Families
Indicators of Compromise (15 / 140 total)