Connect with us

Technology

Fake Windows update pushes malware in new ClickFix attack

Published

on

Fake Windows update pushes malware in new ClickFix attack

NEWYou can now listen to Fox News articles!

Cybercriminals keep getting better at blending into the software you use every day. 

Over the past few years, we’ve seen phishing pages that copy banking portals, fake browser alerts that claim your device is infected and “human verification” screens that push you to run commands you should never touch. The latest twist comes from the ongoing ClickFix campaign.

Instead of asking you to prove you are human, attackers now disguise themselves as a Windows update. It looks convincing enough that you might follow the instructions without thinking, which is exactly what they want.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Advertisement

NEW SCAM SENDS FAKE MICROSOFT 365 LOGIN PAGES

The malware hides inside seemingly normal image files, using steganography to slip past traditional security tools.  (Microsoft)

How the fake update works

Researchers noticed that ClickFix has upgraded its old trick. The campaign used to rely on human verification pages, but now you get a full-screen Windows update screen that looks almost identical to the real thing. Joe Security showed how the page displays fake progress bars, familiar update messages and a prompt that tells you to complete a critical security update.

If you are on Windows, the site tells you to open the Run box, copy something from your clipboard and paste it in. That “something” is a command that silently downloads a malware dropper. The final payload is usually an infostealer, which steals passwords, cookies and other data from your machine.

NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

Advertisement

Fake update screens are getting harder to spot as attackers mimic Windows with near-perfect precision. (Joe Security)

The moment you paste the command, the infection chain begins. First, a file called mshta.exe reaches out to a remote server and grabs a script. To avoid detection, these URLs often use hex encoding for parts of the address and rotate their paths. The script then runs obfuscated PowerShell code filled with junk instructions to throw researchers off. Once PowerShell does its work, it decrypts a hidden .NET assembly that functions as the loader.

Why is this attack so hard to detect?

The loader hides its next stage inside what looks like a regular PNG file. ClickFix uses custom steganography, which is a technique that hides secret data inside normal-looking content. In this case, the malware sits inside the image’s pixel data. The attackers tweak color values in certain pixels, especially in the red channel, to embed pieces of shellcode. When you view the image, everything appears normal.

The script knows exactly where the hidden data sits. It extracts the pixel values, decrypts them and rebuilds the malware directly in memory. That means nothing obvious is written to disk. Security tools that rely on file scanning miss it, since the shellcode never appears as a standalone file.

Once rebuilt, the shellcode is injected into a trusted Windows process like explorer.exe. The attack uses familiar in-memory techniques such as VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Recent ClickFix activity has delivered infostealers like LummaC2 and updated versions of Rhadamanthys. These tools are built to harvest credentials and send them back to the attacker with very little noise.

Advertisement

Once the hidden code loads into a trusted Windows process, infostealers quietly begin harvesting your data. (Kurt “CyberGuy” Knutsson)

7 steps you can take to protect yourself from the ClickFix campaign

The best way to stay protected is to slow down for a moment and follow a few steps that cut off these attacks before they start.

1) Never run commands you didn’t ask for

If any site tells you to paste a command into Run, PowerShell or Terminal, treat it as an immediate warning sign. Real operating system updates never require you to run commands from a webpage. When you run that command, you hand full control to the attacker. If something feels off, close the page and don’t interact further.

2) Keep Windows updates inside Windows

Updates should only come from the Windows Settings app or through official system notifications. A browser tab or pop-up pretending to be a Windows update is always fake. If you see anything outside the normal update flow asking for your action, ignore it and check the real Windows Update page yourself.

3) Use a reputable antivirus

Choose a security suite that can detect both file-based and in-memory threats. Stealthy attacks like ClickFix avoid leaving obvious files for scanners to pick up. Tools with behavioral detection, sandboxing and script monitoring give you a much better chance of spotting unusual activity early.

Advertisement

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

4) Use a password manager

Password managers create strong, unique passwords for every account you use. They also autofill only on legitimate websites, which helps you catch fake login pages. If a manager refuses to fill out your credentials, take a second look at the URL before entering anything manually.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

Advertisement

5) Use a personal data removal service

Many attacks start by targeting emails and personal details already exposed online. Data removal services help shrink your digital footprint by requesting takedowns from data broker sites that collect and sell your information. They can’t erase everything, but reducing your exposure means fewer attackers have easy access to your details.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Check URLs before trusting anything

A convincing layout doesn’t mean it is legitimate. Always look at the domain name first. If it doesn’t match the official site or uses odd spelling or extra characters, close it. Attackers rely on the fact that people recognize a page’s design but ignore the address bar.

Advertisement

7) Close suspicious full-screen pages

Fake update pages often run in full-screen mode to hide the browser interface and make the page look like part of your computer. If a site suddenly goes full screen without your permission, exit with Esc or Alt+Tab. Once you’re out, scan your system and don’t return to that page.

Kurt’s key takeaway

ClickFix works because it leans on user interaction. Nothing happens unless you follow the instructions on the screen. That makes the fake Windows update page especially dangerous, because it taps into something most people trust. If you are used to Windows updates freezing your screen, you may not question a prompt that appears during the process. Cybercriminals know this. They copy trusted interfaces to lower your guard and then rely on you to run the final command. The technical tricks that follow are complex, but the starting point is simple. They need you to help them.

Do you ever copy commands from a website without thinking twice about what they do? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 

Advertisement

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement

Technology

Google’s latest Pixel Watches have fallen to their lowest prices ever

Published

on

Google’s latest Pixel Watches have fallen to their lowest prices ever

With longer days and warmer weather on the way, it’s a good time to take your gym routine outside. Luckily, Google’s Pixel Watch 4 can help you track all your outdoor fitness activities, and right now it’s on sale at Amazon, Best Buy, and Target starting at $289.99 ($60 off), a new low price. The last-gen Pixel Watch 3 is also currently the cheapest it’s ever been, with the 41mm / Wi-Fi configuration selling for $169.99 ($80 off) — also a new low — at Amazon, Best Buy, and Target.

The Pixel Watch 4 is our favorite Fitbit-powered smartwatch, one that offers a great feature set for the price. Google’s latest wearable features dual-frequency GPS, which improves accuracy in challenging environments such as cities and dense forests, and it can automatically record certain cardio activities on your behalf, including both running and cycling. It also offers improved sleep tracking, satellite SOS (on the LTE model), and a slew of AI features courtesy of Gemini — including an exclusive raise-to-talk gesture that’s useful while on a run.

The hardware has improved as well. Most notably, you can now replace and repair both the screen and the battery, making it a better long-term investment. The display is bigger and brighter, too, and the Pixel Watch 4 lasts about a day and a half on a single charge, or roughly 45 hours if you buy the 45mm model (up from 32 hours on the Watch 3). Charging is also faster, allowing you to charge it up to 80 percent capacity in under 30 minutes. And as a nice little extra, the included side-mounted charger lets you use the watch as a glanceable display, so you can see the battery percentage and other useful tidbits of info more easily.

If you want a great Android smartwatch for less, the last-gen Pixel Watch 3 is also a good option. While it’s not easily repairable like the Watch 4 and lacks some of the aforementioned upgrades (including dual-frequency GPS), it still offers a good set of health and fitness tools, allowing you to track your activity, sleep, blood oxygen levels, and heart rate. It also supports Gemini and integrates well with Google’s various services, letting you download offline maps and leave your wallet at home by paying via Google Wallet. You can even use it to control a slew of compatible devices from your wrist, from Nest cameras and video doorbells to the newest Google TV devices.

Continue Reading

Technology

You could be sharing your Social Security number when you don’t need to

Published

on

You could be sharing your Social Security number when you don’t need to

NEWYou can now listen to Fox News articles!

Some Social Security number requests are not optional. Federal reporting systems rely on the SSN as a primary identifier.

Employment offers the clearest example. Employers collect your SSN to report wages and file taxes, including Form W-2 submissions. The Social Security Administration credits your earnings record with it. The IRS uses it to match payroll taxes with reported income. Federal agencies also require your SSN when you apply for certain benefits or meet tax obligations. If you refuse to provide your SSN in these situations, you can delay processing or lose access to services.

However, not every form carries that authority. Landlords, medical offices, schools, gyms and retailers often include an SSN field by default. In those cases, ask why they need it and whether another identifier will work. So how do you tell when your SSN is truly required and when you can push back?

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Advertisement

Your Social Security number powers tax reporting and federal benefit systems, which is why some requests truly are mandatory. (AP Photo/Jenny Kane, File)

Examples of when you need to share your SSN

Certain U.S. laws and federal regulations require an SSN because it functions as the official taxpayer or benefits identifier.

Federal income tax returns: The IRS requires individuals who qualify for an SSN to use it as their taxpayer identification number on Form 1040 and related filings. The IRS uses the number to match income statements, credits and refunds to the correct taxpayer record.

Form W-2 wage reporting: IRS regulations require employers to include each employee’s SSN on Form W-2. Employers submit the form to both the IRS and the SSA so agencies can record earnings and reconcile payroll taxes.

Social Security retirement and disability benefits: Applications for Social Security benefits require an SSN so the SSA can retrieve the applicant’s earnings history and calculate eligibility and payment amounts.

Advertisement

ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

FAFSA for federal student aid: U.S. citizens and eligible noncitizens applying for federal student aid must provide a valid SSN on the Free Application for Federal Student Aid (FAFSA). The number is verified against SSA records during processing.

Interest income reporting: Financial institutions must obtain a taxpayer identification number — usually an SSN for individuals — to report interest income to the IRS on Form 1099-INT.

In each of these cases, the requirement stems from tax administration statutes or federal benefits law. The SSN is used to link records across agencies and systems.

When you don’t need to share your SSN

Beyond tax filings, wage reporting and federal benefits, many SSN requests come from internal company policy rather than statute. Private businesses are generally allowed to ask for your SSN. In most everyday transactions, there is no federal law forcing you to provide it.

Advertisement

Rental applications: Landlords often request an SSN to run credit checks. Federal housing law does not mandate collecting a tenant’s SSN to lease property. Screening is conducted through consumer reporting agencies, and alternative verification methods may be available.

Medical intake forms: Healthcare providers routinely include an SSN field. Federal law does not require patients to disclose an SSN for treatment. Since 2018, Medicare cards have used randomized beneficiary identifiers instead of SSNs. These Medicare Beneficiary Identifiers (MBI) don’t include your SSN.

School enrollment forms: Public schools may request a student’s SSN, but students cannot be denied enrollment for refusing to provide one. Institutions tend to assign their own identification numbers.

TAX SEASON SCAMS 2026: FAKE IRS MESSAGES STEALING IDENTITIES

Utilities and subscription services: Power companies, mobile carriers and gyms sometimes request an SSN to evaluate credit risk or secure payment agreements. This is a risk management choice, not a statutory requirement.

Advertisement

In these cases, the request may feel routine. The legal footing is different from tax or benefits administration. You can ask what authority requires it and whether another form of identification will suffice.

Not every form that asks for your SSN has legal authority behind it. Many requests are simply company policy. (Kurt “CyberGuy” Knutsson)

What to ask before you hand over your SSN

If the request comes from a government agency, look for a Privacy Act disclosure statement. Federal law requires agencies to state whether providing your SSN is mandatory or voluntary, cite the legal authority for the request, and explain how it will be used. If the request comes from a private company, ask direct questions:

Is this required by federal or state law?

What will the SSN be used for?

Advertisement

Can you accept the last four digits instead?

Is there an alternative way to verify identity?

You can also ask how the number will be stored, whether it is encrypted and who has access to it. Collecting only what is necessary is a recognized security practice, but not every organization follows it.

What actually happens when your SSN is leaked

A leaked or stolen SSN can be used anywhere that number is treated as proof of identity.

In tax administration, the IRS processes returns based on the SSN attached to them. If a fraudulent return is filed first, the legitimate taxpayer’s electronic filing may be rejected because the number has already been used. Fixing it means paper filing and identity verification while the IRS reviews the case. The agency’s Identity Protection PIN program was introduced after years of SSN-based tax fraud.

Advertisement

Credit reporting works the same way. Under the Fair Credit Reporting Act framework, credit bureaus use the SSN to build and match consumer files. If credit is issued using your SSN, that account can attach to your report until you dispute it. It stays there while bureaus and lenders investigate.

Federal benefit systems also depend on the number. The SSA warns that criminals use stolen SSNs to impersonate beneficiaries and create fraudulent online accounts. An SSN does not expire or reset. Once exposed, it can continue appearing in tax filings, credit applications, or benefit records until you flag it.

How identity monitoring services help you respond faster

Identity monitoring services attempt to detect suspicious activity tied to your personal information as early as possible. Many services track credit activity across all three major U.S. bureaus and alert you to new inquiries, accounts and report changes. Some also scan known data breach datasets for exposed identifiers, including Social Security numbers.

Certain plans include identity theft insurance to cover eligible recovery costs, along with fraud resolution support to guide you through disputes and paperwork if something goes wrong.

No service can prevent every type of identity theft. The real value is early warning, knowing when and where your SSN is being used so you can act quickly before damage spreads.

Advertisement

How to check if your personal information was exposed

If you are unsure whether your personal information has been compromised, take action. Start with a reputable breach scan to see whether your email or other identifiers appear in known leaks. Early detection gives you more control and helps you respond before fraud escalates.

See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

Before handing it over, ask how your SSN will be used, stored and protected. That simple pause can reduce your risk.  (Kurt “CyberGuy” Knutsson)

Kurt’s key takeaways

Lawmakers created the Social Security number to track earnings and administer benefits, not to unlock every part of your life. Yet today, many companies treat it like a universal key. In some situations, you must provide your SSN. Taxes, employment and federal benefits depend on it. However, many everyday requests come from internal company policies, not federal law. That distinction matters. Before you share your number, pause and ask why the business needs it. Ask how they store it. Ask whether another form of identification will work. Small questions can prevent big problems. If someone has exposed your SSN, act quickly. Monitor your credit. Set up alerts. Report suspicious activity right away. Early action limits damage and protects your identity. Your Social Security number does not change. But you control when, where and how you share it.

Have you ever been asked for your Social Security number in a situation that didn’t feel necessary, and did you push back? Let us know by writing to us at Cyberguy.com.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading

Technology

Apple is going high-end with new ‘Ultra’ products next

Published

on

Apple is going high-end with new ‘Ultra’ products next

Fresh off launching the low-cost MacBook Neo, Apple is reportedly preparing at least three new products that will fit into its highest-end “ultra” lineup. According to Bloomberg’s Mark Gruman, the next batch of releases may not bear the “ultra” name, like its Watch, but will all command price premiums over their mainline counterparts.

There’s the oft-rumored foldable iPhone, which is expected to cost around $2,000, and a touchscreen MacBook Pro is supposedly slated for the fall. Those are pretty straightforward plays for the higher end of the market. More interesting are the next-gen AirPods, which are rumored to include cameras to feed visual context to Siri. Since AirPods already use the Pro and Max branding, similar to Apple Silicon, a set of AirPods Ultra could very well be on the docket.

Between the Neo and multiple foldables in the works, it seems that Apple is simultaneously trying to go further up- and down-market.

Continue Reading

Trending