Technology

Fake Windows update pushes malware in new ClickFix attack

Published

1 month ago

December 13, 2025

Press Room

Fake Windows update pushes malware in new ClickFix attack

NEWYou can now listen to Fox News articles!

Cybercriminals keep getting better at blending into the software you use every day.

Over the past few years, we’ve seen phishing pages that copy banking portals, fake browser alerts that claim your device is infected and “human verification” screens that push you to run commands you should never touch. The latest twist comes from the ongoing ClickFix campaign.

Instead of asking you to prove you are human, attackers now disguise themselves as a Windows update. It looks convincing enough that you might follow the instructions without thinking, which is exactly what they want.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

NEW SCAM SENDS FAKE MICROSOFT 365 LOGIN PAGES

The malware hides inside seemingly normal image files, using steganography to slip past traditional security tools. (Microsoft)

How the fake update works

Researchers noticed that ClickFix has upgraded its old trick. The campaign used to rely on human verification pages, but now you get a full-screen Windows update screen that looks almost identical to the real thing. Joe Security showed how the page displays fake progress bars, familiar update messages and a prompt that tells you to complete a critical security update.

If you are on Windows, the site tells you to open the Run box, copy something from your clipboard and paste it in. That “something” is a command that silently downloads a malware dropper. The final payload is usually an infostealer, which steals passwords, cookies and other data from your machine.

NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

Fake update screens are getting harder to spot as attackers mimic Windows with near-perfect precision. (Joe Security)

The moment you paste the command, the infection chain begins. First, a file called mshta.exe reaches out to a remote server and grabs a script. To avoid detection, these URLs often use hex encoding for parts of the address and rotate their paths. The script then runs obfuscated PowerShell code filled with junk instructions to throw researchers off. Once PowerShell does its work, it decrypts a hidden .NET assembly that functions as the loader.

Why is this attack so hard to detect?

The loader hides its next stage inside what looks like a regular PNG file. ClickFix uses custom steganography, which is a technique that hides secret data inside normal-looking content. In this case, the malware sits inside the image’s pixel data. The attackers tweak color values in certain pixels, especially in the red channel, to embed pieces of shellcode. When you view the image, everything appears normal.

The script knows exactly where the hidden data sits. It extracts the pixel values, decrypts them and rebuilds the malware directly in memory. That means nothing obvious is written to disk. Security tools that rely on file scanning miss it, since the shellcode never appears as a standalone file.

Once rebuilt, the shellcode is injected into a trusted Windows process like explorer.exe. The attack uses familiar in-memory techniques such as VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Recent ClickFix activity has delivered infostealers like LummaC2 and updated versions of Rhadamanthys. These tools are built to harvest credentials and send them back to the attacker with very little noise.

Once the hidden code loads into a trusted Windows process, infostealers quietly begin harvesting your data. (Kurt “CyberGuy” Knutsson)

7 steps you can take to protect yourself from the ClickFix campaign

The best way to stay protected is to slow down for a moment and follow a few steps that cut off these attacks before they start.

1) Never run commands you didn’t ask for

If any site tells you to paste a command into Run, PowerShell or Terminal, treat it as an immediate warning sign. Real operating system updates never require you to run commands from a webpage. When you run that command, you hand full control to the attacker. If something feels off, close the page and don’t interact further.

2) Keep Windows updates inside Windows

Updates should only come from the Windows Settings app or through official system notifications. A browser tab or pop-up pretending to be a Windows update is always fake. If you see anything outside the normal update flow asking for your action, ignore it and check the real Windows Update page yourself.

3) Use a reputable antivirus

Choose a security suite that can detect both file-based and in-memory threats. Stealthy attacks like ClickFix avoid leaving obvious files for scanners to pick up. Tools with behavioral detection, sandboxing and script monitoring give you a much better chance of spotting unusual activity early.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

4) Use a password manager

Password managers create strong, unique passwords for every account you use. They also autofill only on legitimate websites, which helps you catch fake login pages. If a manager refuses to fill out your credentials, take a second look at the URL before entering anything manually.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

5) Use a personal data removal service

Many attacks start by targeting emails and personal details already exposed online. Data removal services help shrink your digital footprint by requesting takedowns from data broker sites that collect and sell your information. They can’t erase everything, but reducing your exposure means fewer attackers have easy access to your details.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Check URLs before trusting anything

A convincing layout doesn’t mean it is legitimate. Always look at the domain name first. If it doesn’t match the official site or uses odd spelling or extra characters, close it. Attackers rely on the fact that people recognize a page’s design but ignore the address bar.

7) Close suspicious full-screen pages

Fake update pages often run in full-screen mode to hide the browser interface and make the page look like part of your computer. If a site suddenly goes full screen without your permission, exit with Esc or Alt+Tab. Once you’re out, scan your system and don’t return to that page.

Kurt’s key takeaway

ClickFix works because it leans on user interaction. Nothing happens unless you follow the instructions on the screen. That makes the fake Windows update page especially dangerous, because it taps into something most people trust. If you are used to Windows updates freezing your screen, you may not question a prompt that appears during the process. Cybercriminals know this. They copy trusted interfaces to lower your guard and then rely on you to run the final command. The technical tricks that follow are complex, but the starting point is simple. They need you to help them.

Do you ever copy commands from a website without thinking twice about what they do? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:cybercrime Featured Microsoft Privacy Security windows os

Click to comment

Technology

One year in, Big Tech has out-maneuvered MAGA populists

Published

5 hours ago

January 21, 2026

Press Room

One year in, Big Tech has out-maneuvered MAGA populists

Welcome to Regulator, a newsletter for Verge subscribers about the technology and the tech bros upending American politics and the Trump administration. If you’re not a subscriber yet, and you’re interested in Silicon Valley’s adventures in sausage-making, you should do so here! It’s Q1! Surely the corporate budget will allow for it.

Precisely one year ago, Steve Bannon, the powerful, populist MAGA podcaster, was thrilled at the sight of the Big Tech CEOs swarming around Donald Trump. In the days before his inauguration, the major players were visiting Mar-a-Lago, signing checks, even showing up to sit quietly behind him during his second inauguration. For years, Bannon told ABC’s Jonathan Karl in an interview, Big Tech had undermined Trump: Jeff Bezos’ Washington Post had reported on him critically, for instance, while Meta and Alphabet’s subsidiaries had purportedly silenced his online presence. Now, Bannon said, they were “supplicants” to Trump, who’d hired MAGA regulators ready to tear apart those companies at any given moment. “Most people in our movement look at this as President Trump broke the oligarchs,” he bragged.

Even smaller pivots from firm MAGA positions in favor of the tech industry, and the response from said base, are telling. Last November, Trump sparked outrage from the right by defending the existence of H1-B visas for high-skilled foreign tech workers, going so far as to say that US workers lacked “certain talents” that prevented Big Tech from hiring domestically. Although Trump ended up radically overhauling the immigration lottery system in a more nativist favor, the continued existence of the H1-B visa program itself sparked a massive rift within the MAGAsphere: how could Trump let in any foreign workers, much less imply that they were better than American workers? What sort of “America First” was that?

For decades, even as a businessman, Trump’s had one consistent organizational principle: people and factions must constantly fight each other for his attention and favor. It happened all the time during Trump’s first term, when New York financiers, the Republican establishment, the career officials, Trump’s children, and the proto-MAGA wing were all fighting each other inside the West Wing. But by the time Trump returned to the campaign trail in 2024, the New Yorkers were exhausted and went home, the Republican establishment had caved to Trump, and the career officials were all about to be purged. MAGA populism had won, and they believed, to paraphrase Trump, that they would win so much that they would become tired of winning. It’s not like the populists haven’t claimed territory in Trump’s second administration. The Department of Justice is conducting lawfare against Trump’s critics, the Department of Homeland Security has given ICE a broadly terrifying mandate, and the Department of Defense (sorry, War) kidnapped a foreign head of state for the LOLs.

But honestly, I would not have expected a year ago, as I watched the tech CEOs applaud Trump in the Rotunda, that these “supplicants” would eventually sway Trump to their ways. I’m not sure how the next year looks for internal drama coming out of the White House. I will say, however, that it is very, very telling that Bannon, who once bragged that there was a plan in place for Trump to run for an unconstitutional third term, is reportedly eyeing a presidential run himself.

Well, in the sense of the Senate being on a one-week recess, during which I will be following the drama of Coinbase derailing the CLARITY Act over interest rates, before the Senate Banking Committee reconvenes. To my great regret, I am not at Davos, where CEO Brian Armstrong is and where most of the negotiations seem to be happening. So if you are in some private Swiss meeting with other tech overlords and have some insight into whether there will be an actual market structure bill passed in the upcoming year, please email me at tina@theverge.com, or over Signal at tina_nguyen.19.

Technology

FDA clears first at-home brain device for depression

Published

6 hours ago

January 21, 2026

Press Room

FDA clears first at-home brain device for depression

NEWYou can now listen to Fox News articles!

For the first time, Americans with depression will soon be able to use a prescription brain-stimulation device at home.

The approval comes from the U.S. Food and Drug Administration and marks a major shift in how mental health conditions may be treated. The newly approved device is called FL-100, and it comes from Flow Neuroscience.

It is designed for adults 18 and older with moderate to severe major depressive disorder. Clinicians can prescribe it as a stand-alone treatment or alongside antidepressants and therapy. This decision matters because depression affects more than 20 million adults in the U.S. Roughly one-third do not get enough relief from medication or stop taking it due to side effects.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

SIMPLE DAILY HABIT MAY HELP EASE DEPRESSION MORE THAN MEDICATION, RESEARCHERS SAY

Flow Neuroscience has gotten approval from the U.S. Food and Drug Administration for its FL-100 prescription brain-stimulation device. (Flow Neuroscience)

How the Flow FL-100 works

The FL-100 uses transcranial direct current stimulation, often shortened to tDCS. This technology delivers a gentle electrical current to the prefrontal cortex, a region of the brain tied to mood regulation and stress response. In many people with depression, activity in this area is reduced. By stimulating it, the device aims to restore healthier brain signaling over time. The system looks like a lightweight headset and pairs with a mobile app. Patients use it at home for about 30 minutes per day while clinicians monitor progress remotely.

The clinical results behind the approval

The FDA based its decision on a randomized controlled trial that evaluated home use under remote supervision. Participants who received active stimulation showed meaningful improvement on clinician-rated and self-reported depression scales. After 10 weeks of treatment, patients experienced an average symptom improvement of 58% compared to a control group. Many users reported noticeable changes within the first three weeks. The study was published in the journal Nature Medicine, adding credibility to the findings. Side effects were generally mild and short-term. Reported issues included skin irritation, redness, headaches, and brief stinging sensations at the electrode sites.

The FDA has approved the first prescription brain-stimulation device for at-home treatment of depression in the U.S., marking a major shift in mental healthcare. (hoto by ISSAM AHMED/AFP via Getty Images)

A growing shift toward tech-based mental health care

Flow’s device has already been used by more than 55,000 people across Europe, the U.K., Switzerland and Hong Kong. In the U.K., it is prescribed within parts of the public health system. Company leaders say the U.S. approval opens the door for broader access to non-drug treatment options. The momentum is not isolated. In 2025, researchers at UCLA Health developed another experimental brain-stimulation approach, signaling rapid growth in this field. Together, these advances suggest that at-home neuromodulation may soon become a standard part of depression care rather than a fringe option.

When will the device be available

Flow expects the FL-100 to be available to U.S. patients in the second quarter of 2026. A prescription will be required, and the companion app will be available on iOS and Android. The company also plans to explore additional uses for its platform, including sleep disorders, addiction, and traumatic brain injury.

10 HEALTH TECH PRODUCTS STEALING THE SPOTLIGHT AT CES 2026

Flow Neuroscience’s FL-100 headset delivers mild electrical stimulation to the brain and can be prescribed for home use under medical supervision. (Flow Neuroscience)

What to know before trying Flow

Flow is FDA approved for adults 18 and older with moderate to severe major depressive disorder, and it requires a prescription from a licensed healthcare provider. Doctors can recommend it on its own or alongside medication or therapy. The headset is non-invasive and designed for home use, but it is not meant for emergency situations or people considered treatment resistant. It also does not replace crisis care or immediate mental health support. Most users wear the headset for about 30 minutes per session. Mild tingling, warmth, skin irritation or headaches can happen, especially early on. These effects are usually short-lived and monitored by a clinician through the companion app.

Flow pairs with a mobile app that guides treatment and supports remote clinical oversight. Your provider sets the treatment plan, and the device follows prescribed settings to ensure safe use. Pricing and insurance coverage may vary once the device becomes available in the U.S. Some patients may access Flow through clinics, research programs, or as it becomes more widely adopted in routine depression care. The bottom line is simple. Flow adds another evidence-based option, not a cure and not a one-size-fits-all solution. For people who have struggled to find relief, having another clinically proven choice can matter a lot.

What this means to you

If you or someone you care about struggles with depression, this approval expands the range of real treatment options. It offers a non-drug path that can be used at home under medical guidance. For patients who have not responded well to medication or who experience unwanted side effects, this could provide another way forward. It also reflects a broader trend toward personalized, tech-enabled mental healthcare.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

ELON MUSK SHARES PLAN TO MASS-PRODUCE BRAIN IMPLANTS FOR PARALYSIS, NEUROLOGICAL DISEASE

The newly approved device targets adults with moderate to severe depression and can be used alongside medication or therapy. (Photo by Sarah Silbiger/Getty Images)

Kurt’s key takeaways

This FDA approval feels like a real turning point. For years, brain stimulation for depression stayed locked inside clinics. Now it can happen at home with a doctor still guiding the process. That matters for people who have tried medications, dealt with side effects or felt stuck with limited options. This device will not be the right answer for everyone, but it gives patients and doctors one more proven tool to work with. And for many people living with depression, having another option could make all the difference.

If a doctor could prescribe a brain-stimulation headset instead of another pill, would you be open to trying it? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Technology

Google has finally killed the Stadia Bluetooth tool — but this person rescued it

Published

17 hours ago

January 20, 2026

Press Room

Google has finally killed the Stadia Bluetooth tool — but this person rescued it

Christopher Klay, who previously developed the Stadia Enhanced browser extension, is one of many who saved a copy of the tool to a personal GitHub page. What’s more, they’re hosting a working copy of that Google website right here to make it even easier.