Threat Intelligence

Global – October 12, 2026 -- Incidents involving fake CAPTCHA lures rose 563% in 2025, according to the CrowdStrike 2026 Global Threat Report, as adversaries including STARDUST CHOLLIMA and VOODOO BEAR adopted the social engineering technique known as ClickFix.

ClickFix turns the victim into the execution mechanism

The attack shows a fake error, CAPTCHA or system message and tells the user to copy a command into the Windows Run dialog, PowerShell or Terminal. In some variants, malicious JavaScript places the command on the clipboard directly.

The pasted command can launch PowerShell, VBScript or another legitimate interpreter to fetch further payloads. CrowdStrike observations show follow-on activity including malware deployment, credential theft, persistence, command and control, and data theft.

South Korea – October 12, 2026 -- CrowdStrike Intelligence has linked a late-September to early-October 2026 campaign against South Korean financial organizations, which resulted in exfiltrated data, to attacker servers that exposed Claude Code session histories, ARTEX configuration files and Claude memory files.

The actor used ARTEX, a recently released open-source agentic penetration testing tool developed in China, alongside large language models (LLMs). CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated, based on the tool choice and Chinese-language prompts. The activity has not been attributed to a named adversary.