Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Proactive ClickFix Threat Hunting with Hunt.io

hunt.io | blog | #threat-hunting | #social-engineering | #huntsql | #clickfix | #malware-delivery | #clipboard

Summary

A case study in proactively hunting ClickFix delivery pages: custom HuntSQL queries surface live, previously unreported malicious domains behind the Windows Run-dialog clipboard trick.
Published
Collected

original ↗

Related coverage

blog · hunt.io
The Complete Guide to Hunting Cobalt Strike - Part 4: Operationalizing C2 Feeds with API Automation
Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.
blog · hunt.io
ClickFix Facebook Session Hijacking Campaign Targets Creators at Scale
ClickFix hijacks live Facebook sessions via fake verification and appeal flows aimed at creators: 115 pages, eight serverless exfiltration endpoints, and 103 related hostnames found by title pivot.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike - Part 2: 10+ HuntSQL Recipes to Find Cobalt Strike
Part 2 of the Cobalt Strike series: ten-plus HuntSQL recipes for detecting, grouping and tracking C2 infrastructure by certificate reuse, beacon traits and enrichment—from real hunting scenarios.
blog · hunt.io
Hunting C2 Panels: Beginner's Guide for Identifying Command and Control Dashboards
A beginner's guide to hunting exposed C2 panels—Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit and Mythic—using URL paths, titles, favicon hashes and HuntSQL datasets.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
back