Researchers say the CRPx0 cybercrime operation uses “ClickFix” lures (fake Windows Update and fake Google reCAPTCHA pages) to trick people into running commands that install ransomware. The group also advertises a white-label ransomware service and claims its victim count rose sharply, with data stolen before encryption and a short deadline to pay before leaks.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re browsing, and suddenly a page says: “Windows Update required: copy/paste this PowerShell command into Run to continue.” That’s ClickFix from a group called CRPx0. They’ve hit 48 organizations by getting people to paste their command into the Windows Run box, which quietly pulls ransomware and steals files before anything gets encrypted. They also use a fake Google reCAPTCHA page that says, “reCAPTCHA verification required: run the provided command to complete the check.” Real CAPTCHAs never make you run PowerShell or Terminal commands, ever. If any website ever tells you to copy a PowerShell or Terminal command to ‘fix’ an update or pass a CAPTCHA, stop immediately and report it to Security, do not run the command.
Attackers are abusing excitement around GTA VI leaks by distributing a fake 113GB “playable build” that is mostly empty data with a small malware payload hidden inside. The malware attempts to weaken defenses by adding Windows Defender exclusions and killing security tools, then likely prepares the…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Microsoft and ReliaQuest report a real campaign where Russian-linked hackers compromised hotel Wi‑Fi networks and redirected travelers to fake Microsoft login pages or fake update screens. The goal was to steal Microsoft 365 credentials and/or trick victims into installing espionage malware,…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
