
← Back to Labs
← Volver a Labs
Medium
Campaign, CyberCrime, LOLBin
Defense Evasion
EDR, Sysmon, Windows
Deno as a LOLRuntime: ClickFix Campaign Evades Controls and Steals Credentials
A widespread ClickFix campaign compromises WordPress sites to display fake Cloudflare prompts, tricking victims into running PowerShell that installs Deno as a loader for Python-based credential and cryptocurrency-stealing malware.



