Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks

Hackers are using ClickFix tricks to install malware loaders and Python tunnels on Windows systems, creating access that could support ransomware attacks. A late September incident shows how a user running a command can start an infection chain built around trusted Microsoft programs, hidden code, and encrypted network traffic. The attack was stopped before ransomware reached the affected systems. However, the tools and methods matched activity previously linked to Vice Society, a cybercrime group associated with Rhysida ransomware. That connection points to a likely ransomware goal, not proof that encryption occurred…