Threat Analysis: ClickFix Campaigns, Check Point Authentication Bypass, and Zimbra RCE, What UK SMBs Need to Know
Hello, Mauven here.
This is your Daily Threat Analysis for the 25th of August 2026.
Three items today. One is a social engineering technique that has matured to the point where it now has its own named malware ecosystem. One is a critical authentication bypass in firewall management software that is confirmed as actively exploited in the wild. And one is an email server vulnerability that attackers have been quietly running through, 270 compromised instances at last count.
None of these are hypothetical. All three require a response today.
ClickFix: The Social Engineering Technique That Grew Up
ClickFix has been around long enough that the NCSC has referenced the general technique in advisory material. The fact that we are still watching it proliferate tells you what you need to know about how seriously the average organisation takes social engineering guidance.
What the latest research shows is that ClickFix has matured into a cluster of related campaigns that share infrastructure and technique but vary their delivery mechanism, presumably to stay ahead of detection. Researchers at Field Effect identified three distinct delivery chains operating concurrently:
- MSI packages: Legitimate-looking software installers containing malicious DLLs loaded via sideloading. Victim clicks what looks like a software download, gets a real application, also gets malware.
- NodeJS execution: JavaScript files executed via Node, giving attackers a flexible scripting environment that many endpoint security tools are not configured to monitor effectively.
- Fake CAPTCHA pages: The now-familiar ClickFix lure, a verification page that instructs the user to open a Run dialog and paste a command. The command executes malware. The user thinks they completed a CAPTCHA check.
A separate Malwarebytes report on PavinLoader, a multi-stage loader distributed through ClickFix campaigns among other vectors, adds further detail. PavinLoader uses heavily obfuscated .NET DLLs, abuses legitimate Windows tools including MSBuild, and retrieves command-and-control domains via blockchain using a technique called EtherHiding. The blockchain angle is not academic: it makes the C2 infrastructure significantly harder to block at the network level, because you cannot simply firewall off a traditional domain.
A macOS variant of the ClickFix crimekit has also been identified, deploying a persistent backdoor agent that stores C2 addresses in Polygon blockchain smart contracts alongside XMRig for cryptomining. This is not just a Windows problem.
There is a related campaign worth noting: a network of fraudulent websites branded as “SysScan”, dressed up with Microsoft logos, are running fake security scans that guarantee a failing score, then instruct victims to call a support number and, in some cases, uninstall their legitimate antivirus software. Eleven sites were identified running on a single server. This is not sophisticated nation-state tradecraft. It does not need to be. It works.
What this means for UK SMBs: ClickFix campaigns are not targeting specific organisations. They are running at volume, using SEO manipulation, malvertising, and compromised legitimate sites to reach whoever clicks. Your staff do not need to be doing anything obviously suspicious to encounter one of these lures. A Google search for software, a sponsored result, a link in a forum, any of these can be the entry point.
What to do:
- Ensure endpoint protection is configured to monitor script execution environments, including NodeJS and PowerShell, not just traditional executable files.
- If your business uses Macs as well as Windows machines, do not assume macOS provides inherent protection here. It does not.
- Brief staff on the fake CAPTCHA technique specifically. The instruction to open a Run dialog and paste text is a reliable indicator. No legitimate website does this.
- Review whether your network controls can limit outbound connections to unexpected or unusual destinations. EtherHiding via blockchain complicates this, but general egress filtering remains useful.
Check Point SmartConsole: Authentication Bypass Under Active Exploitation
This one requires immediate attention if you run Check Point security management products.
Check Point has published an urgent advisory confirming active exploitation of CVE-2026-16232, a critical authentication bypass affecting SmartConsole, the management interface for Check Point Security Management, Multi-Domain Management, Quantum Security Gateway, and the Gaia operating system. The vulnerability allows an unauthenticated remote attacker to bypass the SmartConsole login entirely and gain full administrative access to exposed management servers.
The advisory confirms exploitation in the wild against customers with a specific configuration: management servers exposed directly to the internet without IP address restrictions. That is the configuration that matters here. If your Check Point management interface is not internet-exposed, your risk profile is different, lower, though not zero, since lateral movement from an already-compromised network remains a vector.
Two additional CVEs accompany the primary vulnerability, CVE-2026-62144 and CVE-2026-62145, covering privilege escalation paths that compound the impact if an attacker does gain initial access.
What this means for UK SMBs: Many smaller organisations manage their firewall infrastructure through IT service providers or MSPs who run centralised management servers. If your provider uses Check Point, the question is not whether their management server is patched, it is whether it was ever exposed in a configuration vulnerable to this. Ask directly. The advisory from Check Point is specific about the exploitation condition. Your provider should be able to answer whether that condition applied to their infrastructure and what remediation steps they have taken.
What to do:
- Apply Check Point’s security updates immediately. There is no workaround that substitutes for patching here.
- Restrict management server access to specific IP ranges. This should have been in place before today; if it was not, it needs to be now.
- Review logs on management servers for any authentication attempts or administrative actions that cannot be attributed to known administrators.
- If you use an MSP for firewall management, contact them today and ask specifically about CVE-2026-16232 remediation status.
Zimbra RCE: 270 Servers Down, Campaign Ongoing
According to Shadowserver data reported by BleepingComputer, threat actors have already compromised over 270 Zimbra Collaboration Suite instances via a high-severity remote code execution vulnerability. The attack exploits command injection in ZCS, allowing unauthenticated remote code execution against unpatched servers. The campaign is described as ongoing.
Zimbra is used by organisations that want email infrastructure they control directly, typically for cost reasons or data sovereignty requirements. It has a meaningful presence among UK professional services firms, legal practices, and public sector adjacent organisations. It is also popular with managed hosting providers who offer it as a white-label email platform to their customers.
The advisory to check if you are using Zimbra is not entirely straightforward: if your email is managed by a third party, you may not know what platform sits underneath it. This is precisely the kind of supply chain question that smaller organisations routinely cannot answer.
What this means for UK SMBs: If your business email is self-hosted or hosted by a small provider, there is a non-trivial probability that Zimbra is in the stack. A compromised email server gives attackers access to your entire email history, your contact list, your internal communications, and, depending on configuration, credentials for other systems. It is also a position from which to conduct highly convincing phishing attacks against your clients and suppliers using your legitimate domain.
What to do:
- If you run Zimbra directly: patch immediately. Check the Zimbra security advisories for the specific patch version addressing the RCE vulnerability and apply it.
- If your email is managed by a third party: contact them today and ask specifically whether their email platform uses Zimbra and whether it has been patched against the current RCE vulnerability. If they cannot answer clearly, that is itself a risk signal.
- Review your email server logs for unusual authentication patterns or unexpected outbound connections if you have direct access.
- Consider whether your email provider has communicated anything to you about this incident. Silence is not reassurance.
Sources
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically. And if someone in your network needs the heads-up on any of today’s items, a colleague, a client, a supplier who runs their own email, pass it along. The gap between knowing and acting is where most incidents happen.