Introducing Cavalier’s New Threat Feeds: Deep Dive into ClickFix Monitoring

We are thrilled to introduce three new Threat Feed modules in Cavalier: C2 Data, ClickFix, and PhaaS (Phishing-as-a-service). Together, they give security teams comprehensive visibility into active attacker infrastructure – from infostealer command-and-control (C2) servers to malicious ClickFix pages executing clipboard injection, to turnkey Phishing-as-a-service (PhaaS) kits targeting corporate credentials.

What’s New: ClickFix Monitor

The new ClickFix module provides critical visibility into malicious websites that use fake verification pages, CAPTCHA prompts, and clipboard injection techniques to trick users into executing malicious commands.

Inside Cavalier, you can seamlessly review:

• Detected ClickFix sites
• Clipboard injection and CAPTCHA indicators
• Injected command payloads
• Before-and-after interaction screenshots
• Domain records and associated URLs
• Date filtering and export options

Analyzing Payloads and Deceptive Lures

With ClickFix lures becoming increasingly sophisticated, it is vital to understand the exact mechanisms threat actors are using to deceive employees. Cavalier allows you to investigate flagged sites, view the copied commands presented to victims, and examine visual evidence of the attack.

Uncovering Initial Access: The Infostealer Connection

Perhaps the most powerful capability of the ClickFix monitor is its integration with Infostealer credential telemetry linked to the hosting platform. This pinpoints compromised employee or user credentials that enabled attackers to gain initial access to the server, explaining how a legitimate business domain became a host for malware.

Case Study: The Artlist Breach

We’ve previously documented how legitimate businesses turn into malware hosts, and a recent high-profile example perfectly illustrates this pipeline.

In our recent shared research on how an infostealer infection led to a sophisticated ClickFix campaign at Artlist, we traced the root cause of a compromised Artlist subdomain back to an infostealer infection from August 2023. A freelance developer unwittingly downloaded a pirated copy of Adobe Acrobat PRO DC, infecting their machine. This breach exposed highly privileged WordPress credentials belonging to a Senior Content Executive. Armed with valid, high-privilege access, threat actors were able to inject an advanced EtherHiding script into the blog, which dynamically routed visitors to a ClickFix payload.

With Cavalier’s new Threat Feeds, security teams can now instantly monitor these high-value, trusted domains that have been repurposed by threat actors. This capability pinpoints exactly where they are serving ClickFix prompts and simultaneously reveals the compromised credentials that facilitated the takeover.

Seamless API Integration for Proactive Defense

By feeding these surfaced ClickFix domains and indicators directly into your perimeter controls, firewalls, and DNS sinks, organizations can prevent social engineering attacks and block fake verification pages before employees can interact with or execute copied command payloads.

All datasets are fully accessible via REST API endpoints. Teams can utilize the GET /json/v3/threat-feeds/clickfix endpoint to retrieve detected sites, including domains, URLs, malicious indicators, clipboard activity, CAPTCHA detection, and screenshot evidence, or use the GET /json/v3/threat-feeds/clickfix/{domain} endpoint for specific record lookups.