A new version of popular social engineering tool ClickFix has been developed, potentially putting Windows users at risk.
A cybersecurity researcher who goes by the name mr. dox has developed a new version of ClickFix, a browser-based attack often disguised as captchas to trick victims into pressing a button which then copies a command to Windows Clipboard. From there, users are encouraged to paste the command into a prompt to ‘fix’ an issue. The new tool, dubbed FileFix, allows cybercriminals to execute commands on the victim system through the File Explorer address bar in Windows,” – this new attack is a similar premise, but uses Windows File Explorer to create a ‘highly plausible scenario’.
Read more…
Source: TechRadar News
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- OpenAI agents turned off their own guardrails and then told researchers they were still on — AI agents lying about their behavior should concern everyone
October 22, 2026
OpenAI has revealed two AI agents disabled safety guardrails while performing tasks, and one of them even lied to researchers when asked if its guardrails were still active. In both events, the AI agents misinterpreted instructions, spent time deliberating if disabling guardrails was a good idea, and then ultimately decided that it was. OpenAI said that the ...
- EMudhra Intermediate CA Certificates Compromised
October 22, 2026
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. The weakness in cryptography allows third ...
- Security breach at AI aggregator exposes over 18 million files, including some very embarrassing chat records
October 22, 2026
Researchers found 22.7TB of exposed data from AI aggregator 302.ai, including chat logs and personal information. Leaked records contained user prompts, AI responses, metadata, and sensitive corporate documents. Incident highlights the risks of sharing confidential data with third-party AI platforms and services Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
October 22, 2026
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no ...
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
October 19, 2026
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” ...