October 7, 2026
- ClickFix is hiding its payloads better. Microsoft Threat Intelligence describes compromised sites pre-fetching a script into the browser cache disguised as a PNG, so the pasted command loads locally instead of pulling a remote payload — sidestepping Windows Run dialog length limits and the usual network-stage detections; DNS TXT records are also being used as payload storage (The Hacker News, Dark Reading). Separately, CERT-UA found over 100 compromised Ukrainian websites serving fake Cloudflare checks that drop Lunex Stealer, including a Chromium extension posing as "Microsoft Office Word Editor" and a component reaching the filesystem; tracked as UAC-0277 (The Record). · Threat Activity
in Pre-Auth File Read Hits Eight Atlassian Data Center Products