Blog

Notes from the detection engine

Write-ups from the work itself: how a given attack actually behaves, why the obvious checks miss it, and what separates it from the legitimate pages it resembles.

Subscribe by RSS

8 August 20266 min read
ClickFix: the malware you install yourself
A fake “verify you are human” gate writes a shell command to your clipboard and asks you to run it. No download, no form, no password field — so every classic check scores the page zero. What actually separates it from a documentation page is concealment.
Read

Notes from the detection engine

ClickFix: the malware you install yourself