Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

APT36-Linked ClickFix Campaign Spoofs Indian Ministry of Defence, Targets Windows & Linux Users

hunt.io | blog | #phishing | #india | #clickfix | #httrack | #apt36 | #ministry-of-defence

Summary

A ClickFix-style chain spoofs India's Ministry of Defence press-release portal, cloned with HTTrack, and routes Windows and Linux visitors to OS-specific pages that stage malware.
Published
Collected

original ↗

Related coverage

blog · hunt.io
APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor
APT36 expands beyond military targets to Indian Railways, oil and gas, and the Ministry of External Affairs, using .desktop lures, cron persistence, and the Poseidon backdoor.
blog · hunt.io
ClickFix Facebook Session Hijacking Campaign Targets Creators at Scale
ClickFix hijacks live Facebook sessions via fake verification and appeal flows aimed at creators: 115 pages, eight serverless exfiltration endpoints, and 103 related hostnames found by title pivot.
blog · hunt.io
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66
Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
blog · hunt.io
Track Threat Actors Using Real-World IOC Pivoting
How Hunt.io turns threat actor profiles and IOC pivoting into actionable intelligence, from APT36's 52 IPs and 265 hosts to infrastructure behind the Marks & Spencer and Oyster incidents.
blog · hunt.io
Proactive ClickFix Threat Hunting with Hunt.io
A case study in proactively hunting ClickFix delivery pages: custom HuntSQL queries surface live, previously unreported malicious domains behind the Windows Run-dialog clipboard trick.
back