State-Sponsored Hackers Use ClickFix Tactic to Deploy Malware

State-sponsored hacker groups, including those from Iran, North Korea, and Russia, have used the ClickFix tactic to deploy malicious software between late 2024 and early 2025. Phishing campaigns using this strategy have been attributed to the groups TA427 (alias Kimsuky) and TA450 (alias MuddyWater).