#ClickFix style campaign operated eight bulk registered 588gj*[.]shop lure domains impersonating...

Summary

A threat campaign leveraging the ClickFix attack pattern has registered approximately 588 malicious domains mimicking legitimate AI software 'PureClaw' to distribute multi-stage payloads. The injected malware includes backdoors, AI-gateway implants, and ransomware droppers delivered through rotating final-stage payloads. This represents a sophisticated supply-chain-adjacent attack targeting users seeking AI tools.

Indicators of Compromise

• malware — PureClaw (spoofed)

Entities