{"schema":"sb.node.v1","id":"sb:e/0580ecdcbecf7a0046f5b1d7","kind":"entity","label":{"text":"clickfix","locale":"en"},"identity":{"anchor":"label:en:clickfix","strength":"label"},"asOf":{"knowledgeCutoff":"2026-10-08T15:58:04.276991+00:00","snapshot":"deploy 7e1a8471a23e0f1eb0285c67fee8a6f7d073739a"},"lens":{"kind":"public"},"build":{"plane":"projected","builtFrom":["entity_graph.slim.json","entity_receipts (deploy asset)","event_graph.json","truth_records (deploy asset)","corroborated_record.json"],"rule":"node-projection.entity@v1"},"standing":{"evidence":{"supporting":48,"separatePublishers":12,"basis":"documents that mention the subject and the outlets that carried them; a mention is evidence the referent is in use, not evidence about any claim"},"admission":{"state":"canonical","reason":"entity graph provenance 'curated'; the node carries no promotion receipt in v1","policy":"EQ-PROMOTION (receipt not carried)"},"disposition":{"state":"served","reason":"public record"},"validity":{"from":"2026-09-06","to":"2026-10-07","basis":"first and last day we saw it mentioned; not the subject's own lifetime"},"measurement":{"state":"partial","blind":["assertion coverage 0.292: about 71% of mentions carry no typed assertion"]}},"dimensions":{"domains":["cybersecurity"],"activeDays":23,"assertions":{"military-action":14}},"up":[],"upNote":"An entity is a root: it is contained by nothing. Pan out by following R.","children":{"count":12,"byKind":{"observation":12},"items":[{"id":"sb:o/fdaf2242f3d6a7ba2d9e5950","kind":"observation","label":"darkreading · 2026-10-07 · ClickFix Attacks Evolve to Better Hide Malicious Payloads","url":"https://www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads"},{"id":"sb:o/ee19e6c4deed013f55f62be2","kind":"observation","label":"The Hacker News · 2026-10-06 · ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits","url":"https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html"},{"id":"sb:o/6217d795e24971d414a89da8","kind":"observation","label":"darkreading · 2026-10-01 · Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net","url":"https://www.darkreading.com/threat-intelligence/russia-star-blizzard-apt-ditches-clickfix-widen-phishing-net"},{"id":"sb:o/06baf2052107a69c908da364","kind":"observation","label":"The Hacker News · 2026-10-01 · Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures","url":"https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html"},{"id":"sb:o/8f8ab546b952053596b2856d","kind":"observation","label":"BleepingComputer · 2026-09-30 · Custom ChatGPTs push ClickFix attacks to deploy RAT malware","url":"https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/"},{"id":"sb:o/2a4a0fda5dccef8833fc5f09","kind":"observation","label":"BleepingComputer · 2026-09-24 · Placeholder domain used in dev docs now serves ClickFix attacks","url":"https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/"},{"id":"sb:o/216361f5d5a48830c4399b41","kind":"observation","label":"The Hacker News · 2026-09-24 · 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360","url":"https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html"},{"id":"sb:o/633779bd222979ff12e67605","kind":"observation","label":"The Hacker News · 2026-09-22 · ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks","url":"https://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.html"},{"id":"sb:o/6e6fed7dd5141c34e00f4666","kind":"observation","label":"The Hacker News · 2026-09-21 · ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure","url":"https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html"},{"id":"sb:o/da4ee8dd72e31451140c34ef","kind":"observation","label":"BleepingComputer · 2026-09-18 · Brevo supply-chain attack injected ClickFix scripts on customer sites","url":"https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/"}],"cursor":"c1.eyJpZCI6InNiOmUvMDU4MGVjZGNiZWNmN2EwMDQ2ZjViMWQ3IiwibCI6ImNoaWxkcmVuIiwibyI6MTAsImsiOm51bGwsImEiOiIyMDI2LTEwLTA4VDE1OjU4OjA0LjI3Njk5MSswMDowMCJ9","order":"newest first; we keep the 12 newest receipts for this entity. Its other observations are counted in standing.evidence.supporting but are not addressable in v1"},"relations":{"count":10,"byKind":{"co-mentioned":10},"items":[{"kind":"relation","label":"co-mentioned with ai (31 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/954477a14bd2af1dff9f5b10"},{"kind":"relation","label":"co-mentioned with microsoft (25 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/381e736504279dc58efc8307"},{"kind":"relation","label":"co-mentioned with powershell (22 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/58f4220073fd09d9a3f57b8b"},{"kind":"relation","label":"co-mentioned with google (20 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/3c727d2458eb2df6cfe3c73b"},{"kind":"relation","label":"co-mentioned with captcha (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/8d69dd8270f563d99ee11304"},{"kind":"relation","label":"co-mentioned with crypto (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/4aebe5c521713be441940c54"},{"kind":"relation","label":"co-mentioned with openai (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/b3f5bdf556354b07aa56e5b6"},{"kind":"relation","label":"co-mentioned with russia (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/6a4589ed6eaede03e3bb9f6b"},{"kind":"relation","label":"co-mentioned with ukraine (15 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/59f7f97f0a821c324e62aa24"},{"kind":"relation","label":"co-mentioned with wordpress (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/803b26dc5e0d9b7d385870b3"}],"cursor":null,"order":"situations first, then claims (the subject's own maintained record, then site-wide corroborated clusters; each label ends with its standing), then co-mentions by shared documents, descending. Co-mentions are the ten strongest the entity graph keeps per entity"},"edge":{"state":"continues"},"links":{"rest":"/api/v1/node/e/0580ecdcbecf7a0046f5b1d7","mcp":"traverse {\"id\":\"sb:e/0580ecdcbecf7a0046f5b1d7\"}","page":"/entity/clickfix/"},"limits":{"levelsPerCall":1,"pageSize":10,"maxPageSize":50,"membersMax":50,"statement":"One level per call: depth is 1 and only 1, and there is no whole-graph dump. pageSize 1-50 (default 10); a page limit is a cursor, never an edge. Members are listed up to 50. At most 60 traverse calls a minute per caller (runaway-loop protection, not a meter). One knowledge cutoff is served: the deploy's."},"actions":[{"verb":"unfold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/0580ecdcbecf7a0046f5b1d7\",\"level\":\"children\"}"},{"verb":"fold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/0580ecdcbecf7a0046f5b1d7\"}"},{"verb":"panOut","lit":false,"effect":"read","layer":"cantina","reason":"An entity is a root: it is contained by nothing. Pan out by following R."},{"verb":"follow","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/0580ecdcbecf7a0046f5b1d7\",\"level\":\"relations\"}"},{"verb":"receipts","lit":false,"effect":"read","layer":"cantina","reason":"receipts are the observations below this node; unfold to reach them"},{"verb":"edge","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/0580ecdcbecf7a0046f5b1d7\"}"},{"verb":"asOf","lit":false,"effect":"read","layer":"cantina","reason":"v1 serves one knowledge cutoff, this deploy's; walking an earlier cutoff needs retained history (EQ-REPLAY), which v1 does not keep"},{"verb":"switchObserver","lit":false,"effect":"read","layer":"cantina","reason":"the public record is the same for every observer; traversal through a Watch's lens is not served in v1"},{"verb":"readOriginal","lit":false,"effect":"read","layer":"cantina","reason":"no translation is applied on this node; every label is the source's own text"},{"verb":"save","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"saving applies to a configured Watch; configure one around this node first (free), then save it"},{"verb":"deliver","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"delivery applies to a saved Watch"},{"verb":"format","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"output format applies to a saved Watch"},{"verb":"deltaR","lit":false,"effect":"read","layer":"workshop","reason":"Delta R needs a saved Watch with a previous reading"},{"verb":"read","lit":false,"effect":"read","layer":"docking-bay","reason":"one-time Reads are parked until the Commander decides their shape (#938)"}]}