@TheDFIRReport@infosec.exchange
2026-03-25 15:09 UTC
We’re seeing a “Missing Font” ClickFix chain in the wild.
Flow:
1️⃣ Fake “Missing Font” prompt
2️⃣ Leads to a BSOD-style recovery screen
3️⃣ Prompts users to open Terminal/PowerShell directly (skipping the Run dialog) and execute commands
This variant leans into a more convincing multi-step user flow compared to typical ClickFix lures.
Curious if others are seeing similar activity?
#infosec #DFIR #threatintel
Replies (1)
-
@bongoknight@ioc.exchange 2026-03-25 15:18
@TheDFIRReport@infosec.exchange ErrTraffic have fake missing font template (aka GlitchFix) and is still very active nowadays. https://censys.com/blog/errtraffic-inside-glitchfix-attack-panel/ I find the second one similar to JackFix: https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/ (I hate all these names)