Security Research

Threat intelligence and malware analysis from Anvil Development: campaign breakdowns, indicators of compromise, and detection rules.

Threat Intel October 21, 2026

FortCheck: ClickFix Campaign Targeting Fortnite Players Delivers Multi-Stage Stealer

A YouTube Shorts ad promising free V-Bucks leads to a fake Cloudflare verification page that talks victims into pasting a command into the Windows Run dialog. From there, a twelve-stage chain built almost entirely out of legitimate Windows tools and a real IronPython release delivers a remote-access bot with wallet-targeting code. Full breakdown with IOCs, Sigma and Suricata rules, and MITRE ATT&CK mapping.

Read the full report →