🚨 Fake Google Merchant Center pages are being used with ClickFix-style fake Cloudflare verification. The ClickFix JS is supposed to dynamically fetch a command and copy it to the clipboard, followed by Win+R -> Ctrl+V -> Enter. Interestingly, these sites expose the literal {{WINR}} placeholder, suggesting the ClickFix template/infrastructure is misconfigured and the server-side value isn't being substituted. The actual malicious command is therefore not present in the page source. I found 30 similar URLs, with 100s of such sites appearing to be live right now. IOCs: hxxps://recipebistro[.]com/ hxxps://www[.]kitchensecretbook[.]com/ hxxps://yummyhomebase[.]com/ hxxps://ultimategrillhub[.]com/ hxxps://yumrecipebox[.]com/ hxxps://mastergrillrecipes[.]com/ hxxps://perfectpitmaster[.]com/ hxxps://progrillguide[.]com/ hxxps://mastergrillhub[.]com/ hxxps://grillchefsecrets[.]com/ hxxps://pitmasterrecipes[.]com/ hxxps://mastermyrecipe[.]com/ hxxps://thegrillbible[.]com/ hxxps://searedrecipes[.]com/ hxxps://perfectgrillguide[.]com/ hxxps://www[.]mastergrillrecipes[.]com/ hxxp://freshmenuideas[.]com/ hxxps://grillrecipespro[.]com/ hxxps://dailychefrecipe[.]com/ hxxps://www[.]grillchefsecrets[.]com/ hxxps://www[.]ultimategrillhub[.]com/ hxxps://homehearthcooks[.]com/ hxxps://quickkitchendishes[.]com/ hxxps://www[.]ovenwisdom[.]com/ hxxps://grillmastersrecipes[.]com/ hxxps://www[.]chefstablehub[.]com/ hxxps://www[.]searedrecipes[.]com/ hxxps://grillgastronomy[.]com/ hxxps://grillprocraft[.]com/ hxxps://simplegastronomy[.]com/ #ClickFix #Malware #ThreatIntel @malwrhunterteam @500mk500 @skocherhan @_ChezDaniela @KirkDerpca @urlyzeio @James_inthe_box @AndrewPetrus @muha2xmad

3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a seen on various websites since end of July: urlscan.io/search/#hash%3A31…

1/4 🇺🇦 @500mk500 @_CERT_UA An ongoing campaign compromised multiple Ukrainian websites to display a fake Cloudflare verification ClickFix lure:

🚨 TrickBot is back with a stealthier command and control method. The new variant replaces traditional HTTP communications with DNS tunneling, making malicious traffic harder to detect on Windows. Listen/Read: hackread.com/new-trickbot-va… #CyberSecurity #Malware #TrickBot #Windows

We identified and resolved a security incident on our site earlier today. A compromised account was exploited to inject a malicious script, briefly exposing users to scam content. The site was taken offline immediately, the script removed, and the account secured. We're back up. If you notice anything unusual, reach out.