CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence70
Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence66
ClickFix crews are staging the second stage inside Binance Smart Chain smart contracts
Blackpoint's SOC worked an incident where a fake captcha on the victim company's own WordPress site ran a hidden PowerShell downloader, and the campaign's later stage sits in a blockchain contract no provider can pull.
Publishers:blackpointcyber.com
Reality
- Evidence60
- Adoption30
- Hype gap+15
- Incentives65
- Confidence55
SloppyRAT parks its backup C2 channel on the Polygon blockchain
Zscaler's ThreatLabz found SloppyRAT in June 2026 at the end of a ClickFix chain whose live hosts are all ordinary domains, with a Polygon JSON-RPC lookup held in reserve for when those domains stop answering.
Reality
- Evidence62
- Adoption18
- Hype gap+18
- Incentives60
- Confidence55
Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
Reality
- Evidence68
- Adoption38
- Hype gap−12
- Incentives55
- Confidence60
5,400 hacked WordPress and PrestaShop sites pull their ClickFix payload from a BNB testnet contract
The contract cannot be deleted. Every injected site has to reach a public BNB Smart Chain testnet RPC endpoint to read it. Netskope recommends blocking that pool. The payload has already changed once.
Reality
- Evidence52
- Adoption64
- Hype gap+14
- Incentives58
- Confidence55