Intelligence Insights March 2026

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://redcanary.com/blog/threat-intelligence/intelligence-insights-march-2026/
• Blog Title: Intelligence Insights: March 2026
• Suggested Section: HackTricks Main → Phishing Methodology (new page: Paste-and-Run / ClickFix / FakeCAPTCHA) + Windows (LOLBin mshta.exe) + macOS (Infostealer staging with ditto, AppleScript numeric deobfuscation)

🎯 Content Summary

Intelligence Insights: March 2026 — Improved high-fidelity technical summary

Red Canary’s “Intelligence Insights: March 2026” summarizes the most prevalent threats observed in February 2026 and focuses on how adversaries achieve initial execution and data theft, especially via RMM abuse and paste-and-run (FakeCAPTCHA/ClickFix) user execution. It also provides concrete behavioral detection opportunities (pseudo analytics) and low-leve...

🔧 Technical Details

Paste-and-run (FakeCAPTCHA / ClickFix) as an initial execution primitive
Attackers use compromised or attacker-controlled web pages to display prompts (often fake CAPTCHA/verification or fix-this-issue dialogs) that instruct victims to copy attacker-provided commands and execute them locally. This shifts execution from the browser sandbox into native OS interpreters/utilities (PowerShell on Windows; shell/curl on macOS), enabling staged download-and-execute chains without a traditional download-and-open workflow.

### macOS stealer staging using ditto to package data for theft
After collecting sensitive artifacts (browser/keychain/wallet data), macOS stealers can compress and stage the loot using the native ditto utility (e.g., ditto -c -k --sequesterRsrc ...) and write archives into locations like /tmp/. This creates a detection angle: suspicious shells spawning ditto with compression flags and output targeting /tmp/ can indicate stealer packaging/exfil prep (with ...

🤖 Agent Actions

Updated clipboard-hijacking.md.

I kept the change to a single file because that page already centralizes ClickFix/FakeCAPTCHA tradecraft. The added content is limited to gaps not already covered: March 2026 mshta.exe external-URL execution as a LOLBin hunting pattern, macOS ditto -c -k --sequesterRsrc ... /tmp/... staging for stealer exfil prep, and the AppleScript numeric character id deobfuscation pattern seen in AMOS. I also added the March 2026 Red Canary blog to the references section.

Verified with sed, tail, and git diff. No other files were modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://redcanary.com/blog/threat-intelligence/intelligence-insights-march-2026/

Content Categories: Based on the analysis, this content was categorized under "HackTricks Main → Phishing Methodology (new page: Paste-and-Run / ClickFix / FakeCAPTCHA) + Windows (LOLBin mshta.exe) + macOS (Infostealer staging with ditto, AppleScript numeric deobfuscation)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0