a hacker's new website

Item: a hacker's new website
Rating: 4
Author: PostSingularity Institute

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity URComputer security URHComputer fraud and hacking

🎙 John Hammond 👥 2.2M 📅 October 7, 2025 ⏱ 20 min 👁 34K 📄 expert opinion 🧭 2026-08-16

Available in: English (current) Français

Keywords

ClickFixsocial engineeringmalwareliving off the landcommunity project

Summary

In this video, John Hammond discusses the ClickFix social engineering technique, which tricks users into running malicious commands via clipboard manipulation and keyboard shortcuts. He explains how this technique has evolved and become widespread, with various variants like ‘file fix’ and ‘download fix’. He then introduces his idea for a comprehensive resource to catalog these techniques, similar to LOLBins. He shares that he started building a wiki (clickfix.wiki) but realized he couldn’t maintain it alone. He reached out to Mike Haggis, a threat researcher, who had already created a similar project called ClickGrab. They decided to merge their efforts, and the ClickGrab website now includes a ’techniques’ section contributed by John. The video also covers potential variations using native Windows binaries, such as DXDiag or MRT, and emphasizes the importance of user education and hardening measures. John encourages community contributions to expand the resource and highlights the growing prevalence of ClickFix attacks.

152 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable insights into the ClickFix technique, its variations, and the importance of community-driven resources for cybersecurity. John’s argumentation is based on his experience and observations, making it credible but not rigorously scientific. He effectively demonstrates the need for awareness and collaboration, but the lack of formal data or case studies weakens the overall argument.

66 words

Title / Content Match

The title is somewhat vague but accurately reflects the content: the creator introduces a new website (ClickGrab) and discusses ClickFix techniques.

Quality & Reliability

7/10

The video is an expert opinion and project announcement from a well-known cybersecurity educator. It provides practical insights into ClickFix techniques and introduces a community resource. However, it lacks formal citations and relies heavily on personal experience and anecdotal evidence.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

ClickFix Wiki — John's initial project for cataloging ClickFix techniques.
ClickFix Wiki (alternate) — Alternate URL for the ClickFix wiki.
ClickGrab — Mike Haggis's project for analyzing ClickFix attacks.
ClickGrab GitHub — Source code repository for ClickGrab.
ClickGrab Website — Hosted version of ClickGrab.
Microsoft Security Blog on ClickFix — Microsoft's analysis of the ClickFix technique.

Concurring Sources

Microsoft Security Blog on ClickFix — Provides an analysis of ClickFix and its prevalence, aligning with the video's claims.

External References

Contribution & Novelties

The video introduces a new community-driven resource (ClickGrab) that consolidates ClickFix techniques, including variations and mitigations. It highlights the importance of collaboration in cybersecurity research and provides practical examples of using native Windows binaries for social engineering attacks.

Pour aller plus loin :

Living Off the Land Binaries, Scripts and Libraries — A comprehensive list of native binaries that can be abused for malicious purposes.
MITRE ATT&CK Technique T1204.002 — User Execution: Malicious File, which relates to ClickFix attacks.
Sigma Rules — A collection of detection rules that can be used to identify ClickFix-related activity.

95 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with moderate technical depth and reliability. This indicates a well-informed but not deeply technical video, suitable for a broad audience interested in cybersecurity awareness.

Reliability 7/10