ClickFix
A lure that tells the visitor the page is broken and asks them to fix it: copy this, press these keys, paste, run. The victim performs the delivery by hand, so nothing was downloaded and nothing was blocked.
Why it matters to you
Every automated control is bypassed by asking the user to be the delivery mechanism. Awareness training that covers only attachments and links does not cover this.
Where we meet it
The lure text is copied between crews with small edits, which makes the wording itself trackable across campaigns that share nothing else.
Connected terms
Traffer
The distribution worker of the stealer economy: drives victims to infected downloads via malvertising, fake installers, cracked software and phishing. Organized into teams with quotas and payout shares.
Traffic distribution system (TDS)
A filtering layer in front of a malicious page that decides who gets to see it: the right country, the right browser, not a sandbox, not a crawler. Everyone else is sent somewhere harmless.
Crypt / FUD
Crypting is the service of repacking malware until antivirus engines stop recognizing it. FUD, "fully undetectable", is the advertised result, sold with a guarantee and re-crypts included.
Read elsewhere
Where this term stops being vocabulary
Dragnet is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the playbook
Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
Business Email Compromise (BEC)
Fraud committed from inside a real mailbox: the attacker reads the thread, waits for an invoice and answers it with different bank details. No malware, no attachment, nothing for a scanner to find.
Callback phishing
An email that carries no link and no attachment, only a plausible invoice or subscription notice and a phone number to dispute it. The attack begins when the victim calls, and the person who answers walks them into installing remote access software.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.