This week, Tanium’s Cyber Threat Intelligence (CTI) team shares an update on three emerging threats. First, we examine the rapid evolution of a browser-based threat called ClickFix. Next, we explore how spikes in malicious activity often precede vulnerability disclosures. Finally, we take a closer look at a Vietnamese-speaking threat group behind a global PXA Stealer campaign.
ClickFix campaign hijacks CAPTCHAs for stealthy malware delivery
A recent report from Guardio Labs explores the rapid evolution of a browser-based threat known as ClickFix. This attack uses fake CAPTCHA overlays to trick users into executing malicious PowerShell commands copied to their clipboard, which bypasses traditional download-based malware delivery.
Replacing older tactics like ClearFake, ClickFix spreads through compromised websites, malvertising, and branded phishing campaigns to deliver credential-stealing malware.
Guardio attributes its success to increasingly sophisticated narratives and advanced evasion techniques that make detection and prevention more difficult.
From fake updates to clipboard exploits
Guardio’s research begins with ClearFake, a campaign active in early 2024 that used compromised WordPress sites to push fake browser update notifications. These updates appeared legitimate but were actually used to deliver Lumma Stealer malware.
Building on this tactic, ClickFix emerged shortly after as a more refined variant, shifting from file-based payloads and instead using deceptive CAPTCHA pages to execute malicious clipboard-based commands.
Interestingly, the fake CAPTCHA concept didn’t originate as a malicious tactic—it was first introduced as a red team simulation tool designed for security training exercises. But like many legitimate techniques, it was quickly adopted and weaponized by threat actors.
ClickFix’s expanding reach
ClickFix initially spread through ad networks and malvertising, relying on broad exposure to reach unsuspecting users. But as attackers sought higher-value targets, they shifted tactics—embedding CAPTCHA payloads into compromised legitimate websites that users already trusted.
From there, the campaign expanded into social media and developer platforms, where fake personas now spam comment sections with misleading recommendations and links to malicious downloads.
Smarter social engineering through familiar design
As ClickFix has matured, its visual tactics have evolved as well. While early versions mimicked Google’s reCAPTCHA, the campaign now imitates other familiar challenges like Cloudflare to maintain credibility.
By pairing these deceptive overlays with urgency cues and realistic branding, threat actors make the social engineering even more convincing and dramatically increase the likelihood of user interaction.
Technical advancements and cross-platform payloads
Beyond social engineering, ClickFix has grown increasingly sophisticated on the technical front. Attackers now obfuscate commands, use dynamic script loading, hide links with URL shorteners, and embed payloads in seemingly legitimate file sources.
As of June 2025, they’ve also begun leveraging the Google Scripts platform to host fake CAPTCHA pages—exploiting its trusted reputation to bypass user suspicion. Meanwhile, payloads have evolved to become cross-platform, now capable of targeting Windows, macOS, and Linux.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The ClickFix threat continues to rapidly gain popularity, exemplifying the growing sophistication of social engineering and the growing trend of user exploitation.
This shift from file-based malware to clipboard-based malware execution also marks a significant evolution in terms of threat delivery, making it critical for security teams to monitor both user behaviors and clipboard activity more closely.
Guardio reminds us how techniques like this that mimic real user flows are increasingly dangerous and more likely to be successful.
Malicious activity often precedes CVE disclosures
GreyNoise’s latest analysis uncovers a compelling trend: attacker behavior frequently intensifies in the weeks leading up to the public disclosure of new vulnerabilities. The report identifies repeatable patterns in pre-disclosure activity and emphasizes how early detection can empower defenders to proactively reduce exposure to emerging threats.
Can attack spikes signal imminent vulnerabilities?
GreyNoise observed distinct patterns of malicious activity—such as scanning, brute-force attempts, and exploitation—targeting technologies that were later found to be vulnerable.
By focusing on edge technologies and CVEs rated 6 or higher on the CVSS scale, researchers were able to quantify this pattern and demonstrate how attacker interest often precedes vulnerability announcements.
Mapping the pattern: From activity to disclosure
To validate this hypothesis, GreyNoise analyzed attacker behavior across tags linked to edge technologies. These tags are signature-based identifiers used by GreyNoise to classify and track patterns in Internet-wide scan and attack traffic. They span categories such as scanners, crawlers, brute-force tools, exploit attempts, and known CVE associations—particularly those targeting edge technologies like VPNs, firewalls, and remote access tools.
After filtering for meaningful data, the team identified 216 statistically significant spikes in attacker activity starting from September 2024. Each spike was then matched to a newly disclosed CVE affecting the same technology or product.
Notably, all matched CVEs involved edge technologies from eight enterprise vendors: Cisco, Citrix, Fortinet, Ivanti, Juniper, MikroTik, Palo Alto, and SonicWall.
Attacker behavior as a predictive signal
GreyNoise found that attacker activity spikes typically occurred 3 to 6 weeks before CVE disclosures—with 50% appearing 3 weeks prior and 80% within 6 weeks.
The report also examined how attackers may revisit older vulnerabilities in the lead-up to new disclosures—suggesting a deliberate, strategic approach to exploitation. In several cases, GreyNoise observed spikes in activity around legacy CVEs, such as Cisco CVE-2011-3315, shortly before newer vulnerabilities affecting the same product were revealed.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The research from GreyNoise helps us understand the importance of identifying attacker patterns in general, especially as these patterns relate to the disclosure of vulnerabilities. This requires a shift from reactive to proactive strategies to help identify malicious activities as a precursor to vulnerabilities.
This research also confirms that traditional patch cycles are often too slow. The fact that attacker behaviors often precede vulnerability disclosures indicates that a different approach to vulnerability protection may be necessary. Vulnerability prioritization should be based not only on severity and relevance to the organization, but also on observed attacker interest.
The report from GreyNoise also includes some helpful recommendations for defenders.
Telegram-linked threat group launches global PXA Stealer campaign
A Vietnamese-speaking threat group has initiated a widespread infostealer campaign leveraging PXA Stealer, a Python-based malware. Joint research from SentinelOne and Beazley Security reveals that the operation has led to the theft of more than 200,000 passwords, hundreds of credit card records, and over 4 million browser cookies.
Multi-state malware operation tied to Telegram-based cybercrime market
First observed in late 2024, the campaign has evolved into a sophisticated, multi-stage operation. SentinelOne and Beazley Security uncovered its connection to a Telegram-based marketplace that facilitates the sale of stolen victim data.
Key tactics include sideloading malicious DLLs via signed software like Haihaisoft PDF Reader and embedding malware in archives disguised as common file types. The final payload—PXA Stealer—exfiltrates sensitive data ranging from passwords to browser autofill entries.
Sideloading via Haihaisoft and shifting infrastructure
Since late 2024, researchers have tracked the actor’s ongoing refinement of sideloading techniques and changes to their command-and-control (C2) infrastructure.
One notable tactic observed in April 2025 involves phishing victims into downloading a compressed archive that bundled a signed copy of the Haihaisoft PDF Reader with a malicious DLL. Once executed, the DLL established persistence and retrieved additional payloads hosted on Dropbox.
This phase also marked a strategic shift in the actor’s tooling: moving away from traditional Windows executables in favor of Python-based payloads—a change that suggests an intent to increase modularity and reduce detection risk.
New variant introduces advanced archive-based infection chain
A July 2025 variant observed by Beazley Security introduced more refined tactics. The lure included a signed Microsoft Word 2013 executable, a sideloaded DLL, and a directory named “-” containing additional payloads.
Victims were shown a decoy document referencing copyright violations while a hidden command prompt executed certutil to decode a disguised Python script named images.png.
Telegram bots and Cloudflare relays drive data theft
The final payload, PXA Stealer, is commonly used by Vietnamese-speaking threat actors. It collects and exfiltrates data via Telegram BotIDs, targeting browsers, autofill data, authentication tokens, and Chrome’s App-Bound Encryption Key. It also harvests files from desktop crypto wallets, VPN clients, cloud utilities, and file shares.
The stolen data is packaged into ZIP files and sent via Telegram bots using Cloudflare Worker relays. The report includes a detailed breakdown of targeted applications and the Telegram abuse infrastructure.
Victimology: Global reach with concentrated targeting
Analysis of active BotIDs associated with the PXA Stealer campaign revealed over 4,000 unique victims. The most frequently targeted regions include the Republic of Korea, the U.S., and the Netherlands.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The PXA Stealer logs indicate the targeting of 62 different countries, highlighting how cybercrime is increasingly borderless. This makes attribution more complex when threat actors are using global infrastructure to target such a range of victims.
The data stolen by the PXA Stealer is being resold via Telegram marketplaces, as is the case with many other infostealer data, and shows how cybercrime is becoming more and more commoditized with logs being treated as inventory.
As the report highlights, this is yet another prime example of threat actors exploiting legitimate infrastructure to carry out malicious activity. It serves as a strong reminder of the importance of behavioral detections.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.