In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.

The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls. 

What’s Notable and Unique 

• ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain. 

  
  

• To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators. 

  
  

• The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses. 

Analyst Comments 

ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites. 

Sources 

• The Evolution of ClickFix: From Cleartext to Server Side Polymorphism 

INC Ransom was the most active threat group in July, while activity remained relatively distributed among multiple threat groups, with 19 unique groups observed throughout the month. Alongside INC Ransom, Qilin, Global Secret Group, Anubis, and DragonForce rounded out the five most active threat groups observed in July. Several emerging threat actors were also observed during the month, including Booba Team, Settra, and Global Secret Group.

Figure 1. Activity from the top 3 threat groups in July 2026

 Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:

• In July 2026, Global Secret Group emerged as a new threat actor, leveraging the leaked LockBit 3.0 (LockBit Black) source code. Although the group began operations in June 2026, it quickly accumulated a substantial number of victims on its data leak site (DLS). The group operates through TOR-based negotiation portals and qTox communications. Notably, its DLS provides step-by-step guidance on purchasing Bitcoin, including references to Coinbase and Binance, demonstrating a streamlined, victim-focused extortion process designed to simplify ransom payments.
  
  

• Similar to Fulcrumsec, the recently emerged Settra ransomware group appears to leverage AI-driven analysis of stolen data, publishing detailed and highly structured victim reports on its DLS. Additionally, a potential EDR-disabling tool, edr_blind.exe, was identified in multiple cases, suggesting a focus on defense-evasion capabilities.
  
  

• With the continuation of the FortiBleed campaign, researchers have now identified compromised FortiGate credentials being leveraged by both the INC and Lynx ransomware operations. Analysis revealed direct operational links between the groups, including shared ransomware infrastructure and overlap between FortiBleed victims and ransomware targets. The operators are also incorporating AI to enhance various stages of the attack lifecycle and increase operational efficiency and scale. Notably, Arete also observed an INC ransomware intrusion leveraging FortiBleed-derived access in July, reinforcing the campaign's role as a precursor to ransomware deployment.

Sources

• Arete Internal

In this episode of Arete’s Cyber Campfire podcast, our Threat Intelligence Team discusses trends, statistics, and emerging threat actors from June 2026. Tune in for firsthand insights on today’s threat landscape that can enhance your approach to cyber risk.