MalwareClickFix Turns Legitimate Websites and System Tools Into a Malware Delivery Chain
ClickFix tricks users into running malicious commands via fake Cloudflare checks, using 17,000+ infected sites, blockchain redirects and OS-specific lures.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
191 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Malware
RansomwareRyuk Operator Sentenced as U.S. Case Exposes the Ransomware Group’s Global Reach
Ryuk member Karen Vardanyan sentenced to 2 years in U.S. for 2,400 ransomware attacks collecting $15M from hospitals, firms.
MalwareRemControl Turns Fake IPTV Downloads Into Full Android Banking Surveillance
RemControl Android malware spreads via fake TVTap IPTV pages, stealing banking credentials with overlays, surveillance and remote control.
APTOne Exploit Operator, Three Technology Stacks and Thousands of Exposed Government Records
Chinese-linked actor exploited WordPress, Zyxel and UniFi flaws to breach government networks, stealing 18,566 records and compromising 996 devices.
APTFake Coding Tests Give North Korean Operators a Foothold on 30,000 Devices
North Korea's Contagious Interview used fake coding tests to compromise 30,000 devices and 7,000 crypto wallets, causing $10.71M in losses.
MalwareChainScript RAT Turns Polygon Smart Contracts Into a Movable C2 Directory
ChainScript RAT spreads through fake software installers, uses Node.js and PowerShell, and finds replaceable C2 servers through Polygon smart contracts.
APTNorth Korean Hackers Turn Terraform Job Tests Into a Path Toward Developer Networks
Jade Sleet breached an Indian IT firm via fake Terraform job tests, deploying FLATROOF and ROOFDECK macOS backdoors to steal credentials.
MalwareFBI Domain Seizures Cut Off NightmareStresser’s DDoS-for-Hire Storefront
FBI seized NightmareStresser domains in Operation PowerOFF, disrupting a DDoS-for-hire service linked to hundreds of thousands of attacks.
MalwareKREMLIN Malware Rewrites Chromium Trust Data to Hijack Brazilian Banking Sessions
KREMLIN malware installs rogue Chrome and Edge extensions by rewriting Chromium trust data to steal Brazilian banking credentials and session tokens.
MalwareRuntime-Triggered npm Malware Slips Past Install-Script Protections
A malicious npm campaign hides its payload in normal library functions, bypassing install-script controls and using runtime triggers, reconnaissance, and blockchain C2.
MalwareInside TeamPCP: How Google Disrupted a Supply-Chain Campaign From the Hackers’ Core Chat
Google infiltrated TeamPCP’s inner chat to disrupt a supply-chain campaign, revoke stolen credentials, warn victims and uncover an AI-assisted zero-day exploit.
APTHandala Hack Turns Telegram Into a Control Channel for Windows Espionage
HEAVYGRAM uses Telegram bots to control Windows systems, steal credentials, capture data, evade Defender, and deploy further malware.