As cited
Copy frozen at (site build).
threat intel
A Wretch Client: From ClickFix deception to information stealer deployment
Elastic Security Labs observed increased ClickFix campaigns that leverage a tool called GHOSTPULSE to distribute Remote Access Trojans (RATs) and information-stealing malware. ClickFix exploits user trust through deceptive technical support mechanics to establish initial access for payload deployment.
Why it matters: Practitioners managing endpoint security need to monitor for ClickFix traffic patterns and GHOSTPULSE indicators, as these campaigns directly target end-users with socially engineered fake error messages that lead to RAT and stealer infections.
- Source published
- First seen by Cybersecurity Tracker