THREATOPS

THREAT OPS › Threat News › ClickFix Campaign Generated Via AI Delivers SmartRAT

ClickFix Campaign Generated Via AI Delivers SmartRAT

medzscaler_threatlabzPublished 2026-06-17

IntroductionIn March 2026, Zscaler ThreatLabz observed multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools. Threat actors are leveraging website builders to create convincing lures quickly and at scale, with capabilities ranging from basic credential theft to a ClickFix campaign that delivers remote access trojans (RATs).In this bl

MITRE ATT&CK techniques

Scheduled TaskT1053.005
Screen CaptureT1113
Windows ServiceT1543.003
Command and Scripting InterpreterT1059
Indicator RemovalT1070
PowerShellT1059.001
System ServicesT1569
CompressionT1027.015
Command and Scripting InterpreterAML.T0050

Indicators of compromise

http://64.95.13.238/st.txturl
http://64.95.13.238/payload.phpurl
64.95.13.238ipv4
162.141.111.227ipv4
cartaobb.comdomain
cartaobrb.comdomain
c.windowsupdate-cdn.comdomain
typesantanderbankbradescobankitaubankcaixabankbb.comdomain

Original source: https://www.zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat