I applied for a WordPress job and got a ClickFix attack in reply

I applied for a WordPress development job. The reply thanked me for my portfolio and asked me to join a supposed Google Workspace to read the project requirements. The link led to a page that prepared a fake certificate error and offered commands to execute external code.

I am studying Cybersecurity Engineering at the Virtual University of the State of Guanajuato (UVEG). This case gave me a chance to apply JavaScript analysis, HTTP traffic inspection and evidence handling to something that reached me through my work as a developer. I documented the mechanism and the limits of what I could establish without executing the payloads.

Short answer: ClickFix is a social engineering technique that invents a technical problem to persuade someone to copy and execute a command. In this attempt, a reply to my WordPress Jobs application led to a fake Google Workspace hosted on Google Sites. The HTML and API exposed instructions for Windows and macOS. I stopped before entering the access key; I did not download or execute the payloads and observed no evidence of compromise.

Analysis date: November 5, 2026.

Incident type: recruitment phishing, Google Workspace impersonation and delivery of download-and-execute instructions through ClickFix.

Campaign severity: high, because the deception could lead to execution of external software. This assesses the campaign's risk; it does not claim my device was infected.

Device status: no observed compromise; I visited the site, entered a fictitious email address and inspected traffic and code.

Confidence in the main finding: high, based on the source code, screenshots and HTTP response documented in the report.

Attribution to people, countries, groups or malware families: undetermined.

Safety notice: Suspicious indicators are defanged (hxxps, [.]). Do not open those addresses or execute commands from this campaign. This article retains the full report in an editorial format; it does not distribute executables, malicious scripts or the original HTML. Hashes and technical excerpts come from the documented analysis, not a new execution of the samples.

In this article

• Executive summary
• The job offer as bait
• Evidence and scope
• Attack chain
• Google impersonation
• Iframe and external API
• Base64 deobfuscation
• The Submit button
• Fake error and ClickFix
• Platform-specific commands
• Telemetry and wallets
• Indicators of compromise
• MITRE ATT&CK
• Impact on my device
• Defensive recommendations
• Where to report and what to send
• Limitations and attribution
• Conclusion
• Frequently asked questions
• References

Executive summary

While looking for WordPress projects, I received an email that appeared to be a legitimate response to my application. The sender thanked me for my portfolio and invited me to a supposed Google Workspace collaboration environment to review the project's scope. The visible link text was https://workspace.google.com, but the destination was a Google Sites page under /view/loop-join/workspace.

The page reproduced the Workspace marketing website. Its “Join to Workspace” button opened an email form and then requested the access key provided in the message. Inspecting event listeners and HTTP requests in Chrome DevTools revealed an external iframe on lokolutikov[.]xyz and its /api/commands?land_id=32 API.

The JSON response contained exe, dmg, windows and mac fields with supposed installers and Base64 commands. Static decoding exposed instructions to download and execute a PowerShell script from racleet[.]top, or a Unix/macOS binary from 109.238.87[.]111. The supposed “DMG” pointed to an AppleScript .scpt file.

The iframe HTML copy used in the analysis contained a Base64 wrapper and roughly 7.9 MB of decoded HTML. A key accepted by /api/verify would start a verification animation, a deliberately programmed authentication failure and an expired-certificate screen. That screen encouraged software downloads or command copying, a flow consistent with ClickFix.

The inspected code attempts to persuade the victim to execute a command or installer manually after the fake error. I did not identify a call that directly executed PowerShell, Bash or AppleScript when Submit was pressed. Entering a key and executing a payload are separate steps.

1. Context: the job offer as bait

The listing appeared on WordPress Jobs as WordPress Developer (Project, Remote), dated October 31, 2026, with NovenzaDigital as the stated company, a USD 5,000 budget and famewunozeno01@gmail[.]com as the contact address. It requested WordPress, PHP, HTML, CSS and JavaScript experience, including themes, plugins, integrations and maintenance [1]. That budget was in the listing; it was not a personal financial offer I received afterward. Publication also does not establish that WordPress verified the advertiser's identity: the platform says volunteers moderate its listings [2].

I had replied to that opportunity. I then received an email signed “Tegan” from the same advertised address. It praised my experience, claimed to have reviewed my portfolio and postponed the detailed brief until I joined the supposed workspace.

The social engineering combined a real application, a plausible administrative task and an artificial requirement: use an access code and later update certificates. The hyperlink text borrowed recognition from a familiar platform.

Figure 1. The visible link text differed from the actual destination. I blurred and covered the access code for publication.

2. Available evidence and investigation scope

The report is based on these materials collected during the investigation:

Identifier	Evidence	Observation scope
E-01	Recruitment email screenshot	Sender, lure and access code; without complete SMTP headers.
E-02	URL copied from the email link	Actual destination on Google Sites.
E-03	Fake Workspace screenshots	Appearance and email/access-key forms.
E-04	DevTools / Network screenshot	GET /api/commands?land_id=32, 200 OK response, JSON type.
E-05	JSON copied from DevTools	Download links and platform-specific commands.
E-06	Event-handler screenshot	Submit belongs to the external workspace1.html iframe.
E-07	Two text files containing encoded HTML	Identical copies; decoded code analyzed without execution.

The scope excluded dynamic installer analysis, payload downloads, backend inspection, virtual-machine execution and forensic correlation with the supposed employer's internal logs. The evidence identifies the deception and download-and-execute instructions with high confidence. It does not establish the final malware, its author or the number of victims.

The report records the two code copies as byte-for-byte identical, with these SHA-256 values:

Texto pegado(1).txt  SHA-256:
82d3cd5e14681670ce89c0d78f49e9621230a456fe5b09618c08ba85fab5512e

Texto pegado(2).txt  SHA-256:
82d3cd5e14681670ce89c0d78f49e9621230a456fe5b09618c08ba85fab5512e

Decoded HTML  SHA-256:
425ffcda4caa5fa4d09d256a306425296a77540e4a79bc309ec9d306a81b93de

These hashes identify the page code, not the offered executables. There is no final-payload hash because it was not downloaded. The original code copies are not part of this article's public files.

3. Reconstructed attack chain

[WordPress Jobs listing / follow-up email]
                    |
[Visible text: workspace.google.com]
                    |
[Destination: sites.google[.]com/view/loop-join/workspace]
                    |
[Iframe: lokolutikov[.]xyz/workspace1.html]
                    |
[Email form -> Access key form]
                    |
[POST /api/verify, land_id: 32]
                    |
[If the response indicates success]
                    |
[Verification animation + fabricated error]
                    |
[WORKSPACE_AUTH_CERT_EXPIRED]
                    |
[Fake repair]
          +---------+----------+
          |                    |
[Download installer]     [Copy command]
          |                    |
          +---------+----------+
                    |
[USER EXECUTION]
                    |
[Download / execution of external code]
[Subsequent effects not analyzed]

The transition from Submit to the error requires the API to accept the key. If it returns success: false, the function shows “Invalid key” or the supplied error and allows another attempt. I did not confirm which keys the server accepts. The later stage was reconstructed from code; I did not activate it on the live site.

4. Google impersonation through an embedded page

The actual link led to hxxps://sites.google[.]com/view/loop-join/workspace. Google Sites is a legitimate service where third parties can publish content. Its hosting domain does not guarantee that Google developed or authorized an embedded page.

The interface copied the logo, typography, Gmail, Drive and Meet icons and “The better way to work” message. The observed button called a local JavaScript function instead of opening the official signup flow:

<a onclick="event.preventDefault();openJoin(this)" class="button">
    <span class="button__content">Join to Workspace</span>
</a>

Figure 2. Workspace's appearance inside a Google Sites page.

The button opened a “Workspace mail” field. I entered a fictitious address and the form advanced to “Access key.” This only demonstrates local email-format validation, not server-side identity authentication.

Figure 3. First stage of the form.

Figure 4. I stopped here, before entering the key or pressing Submit.

5. Locating the iframe and external server

In DevTools Event Listeners, the click handler on button#submit-btn pointed to workspace1.html. Its scope (Window, document, location) referenced hxxps://lokolutikov[.]xyz/workspace1.html. The button belonged to an external document rather than Google's official form.

Figure 5. Location of the code responsible for Submit.

The page defined this configuration, defanged here:

window.API_BASE = 'hxxps://lokolutikov[.]xyz/'; // Defanged domain.
window.LAND_ID = 32;

Route	Observed or identified method	Purpose in the code
/api/commands?land_id=32	GET	Retrieve platform-specific links and commands.
/api/verify	POST	Validate the code and assign campaign identifiers.
/api/copy	POST	Record “Copy” clicks.
/api/download	POST	Obtain a URL that may later open in another tab.
/api/downloadmac	POST	Record interaction with the Mac download.

The code also handles a v query parameter: if present, it stores its value in localStorage and sends verification with type: 'visited'. This behavior was not observed in my specific test.

The captured API response was 200 OK, with Content-Type: application/json and Access-Control-Allow-Origin: *. CORS allows other origins to consume the API; that permission alone does not prove malicious activity.

Figure 6. Network request to the external domain.

6. HTML deobfuscation: Base64 as a concealment layer

The source began with this pattern. This is a conceptual excerpt with the Base64 content omitted:

<script>
    document.write(decodeURIComponent(escape(atob('...'))));
</script>

atob decodes Base64 and document.write inserts the resulting HTML into the document. Base64 is a reversible encoding that requires no secret key. On this page it made superficial inspection harder. decodeURIComponent(escape(...)) is a legacy Unicode conversion technique.

Each source copy was roughly 11 MB and produced the same approximately 7.9 MB HTML document. Much of its size came from embedded images and resources. The documented deobfuscation was limited to reading and decoding bytes, without evaluating the resulting JavaScript.

7. Analyzing submitKey(): what the Submit button does

The function reads #access-key, temporarily disables the button and sends JSON to the backend. This excerpt is summarized and neutralized; it is not an example to execute:

function submitKey() {
    const key = document.getElementById('access-key').value.trim();
    const landId = window.LAND_ID || 1;

    fetch(apiBase + '/api/verify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ code: key, land_id: landId }),
    })
        .then((r) => r.json())
        .then((data) => {
            if (data.success) {
                showLoadingSequence();
            } else {
                // Display the code-validation error.
            }
        });
}

The function contains no native-execution call. After an accepted response, an authentication simulation appears: showLoadingSequence() schedules UI states with setTimeout and explicitly marks the second step as failed. Once the animation starts, that failure is predetermined:

// Excerpts from the analyzed interface sequence.
setTimeout(function () {
    completeStep(1, false);
    title.textContent = 'Authentication failed';
    sub.textContent = 'Your account could not be verified';
}, 3600);

setTimeout(function () {
    showErrorPage();
}, 5200);

The JavaScript fabricates the supposed technical problem on the device. The analyzed material contains no genuine check of operating-system certificate expiry.

8. The fake certificate fault and ClickFix deception

showErrorPage() claims it cannot establish a secure connection and that the device needs certificate updates. It uses this error:

WORKSPACE_AUTH_CERT_EXPIRED

The code calls getOS() with navigator.userAgent and navigator.platform to choose Windows or Mac/other flows. On mobile devices detected through userAgent, it displays “Device Not Supported” and asks the visitor to continue on a computer.

The screen prepares two routes:

1. Direct installation: links with data-download-type="exe" or "dmg", replaceable with API-provided URLs.
2. ClickFix: a Copy button takes a command from data-copy, writes it with navigator.clipboard.writeText() and shows instructions to open PowerShell or Terminal and paste it. An alternative copying method is available if the clipboard API fails.

The page's FAQs reassure the visitor. On Windows, they even suggest bypassing SmartScreen through “More info” and “Run anyway.” These instructions aim to achieve manual execution through deception.

The behavior fits T1204.004, User Execution: Malicious Copy and Paste, in MITRE ATT&CK [8], alongside the initial phishing link. The code prepares an attempt; the evidence does not demonstrate completed execution.

9. The /api/commands response: platform-specific instructions

The observed JSON had four keys. These are the defanged locations and inferred behavior, without publishing complete directly executable command strings:

Key	Observed indicator	Possible behavior
exe	hxxps://api.certificate[.]rest/installer/CertificateUpdate.application	.application extension, consistent with Windows ClickOnce installation. Not downloaded or inspected.
dmg	hxxps://api.certificate[.]rest/Installer%20GoogleCert.scpt	Ends in AppleScript .scpt, although the key is called dmg.
windows	PowerShell Base64 / UTF-16LE	Retrieves a remote script, interprets it and removes the local copy.
mac	Base64-encoded Bash/Unix command	Downloads a file named chrome to /tmp, makes it executable and starts it in the background.

9.1 Windows: stages inferred from the decoded command

The string used -NoProfile -w Normal -e and UTF-16LE Base64. Decoding it as text showed:

• Creation of the temporary file %TEMP%\sys.ps1.
• Download from hxxps://racleet[.]top/core using Start-BitsTransfer.
• An Invoke-WebRequest fallback if BITS fails.
• Reading through Get-Content -Raw and interpretation through Invoke-Expression (alias iex).
• Removal of the temporary copy through Remove-Item (alias ri).

The risk is execution of external code. Deleting the .ps1 afterward does not undo effects it may have produced.

9.2 Mac/Unix: stages inferred from the decoded command

The mac value described this sequence:

1. Download a binary from hxxp://109.238.87[.]111/d/unix45351194 to /tmp/chrome.
2. Apply chmod +x to it.
3. Start it in the background, discarding standard output and errors, with disown at the end.

The name chrome does not establish that the file is Google Chrome. It may give the binary a familiar appearance. Because I did not download it, its architecture, hash, capabilities and malware family remain undetermined.

9.3 What I cannot claim

Without analyzing the binaries, I cannot attribute password or cryptocurrency theft, LaunchDaemons persistence or cookie exfiltration to them. Those capabilities are documented in comparable campaigns and malware associated with related infrastructure, but were not verified in this URL's specific file.

10. Telemetry and wallet checks

The code includes logCopy(), logDownload() and logDownloadMac(). The first and third send events to an API; the second may request a download URL from the backend before opening it. A MutationObserver applies commands and links to elements added dynamically to the DOM.

The detectWallets() routine checks properties exposed by wallet providers including MetaMask, Rabby, Phantom, Coinbase Wallet and Exodus. A WordPress vacancy has no need to know which cryptocurrency extensions are in a browser.

I found no demonstrated transmission of that list to a server in the analyzed excerpt. It could be reused code or a capability prepared for another stage. I do not claim wallet access or stolen funds.

11. Indicators of compromise (IOC) and observables

IOCs support investigation and blocking. Finding one in a log or checking its reputation does not by itself prove infection. These are observables from the November 5, 2026 analysis, not a validation of their current status.

Type	Defanged indicator	Role and confidence
Sender	famewunozeno01@gmail[.]com	Sender and listing contact (high).
Entry	hxxps://sites.google[.]com/view/loop-join/workspace	Sites lure (high).
Iframe	hxxps://lokolutikov[.]xyz/workspace1.html	Form code (high).
API	hxxps://lokolutikov[.]xyz/api/commands?land_id=32	OS-specific instruction delivery (high).
API	/api/verify, /api/copy, /api/download, /api/downloadmac	Control and logging (high, static code).
Identifier	land_id=32	Page configuration (high).
Windows	hxxps://racleet[.]top/core	Script source according to the command (high, not downloaded).
Windows	hxxps://api.certificate[.]rest/installer/CertificateUpdate.application	Download specified in JSON (high, not downloaded).
macOS	hxxps://api.certificate[.]rest/Installer%20GoogleCert.scpt	Download specified in JSON (high, not downloaded).
Unix/macOS	109.238.87[.]111	Binary download IP (high).
Unix/macOS	hxxp://109.238.87[.]111/d/unix45351194	Delivery path, contents unvalidated (high).
Intended file	%TEMP%\sys.ps1	Temporary script if the Windows command runs.
Intended file	/tmp/chrome	Local file if the Unix command runs.
Error	WORKSPACE_AUTH_CERT_EXPIRED	Static deception text (high).

External correlation with IP 109.238.87[.]111

The report records other malware-distribution paths for that IP in URLhaus from September 2026 onward [4]. The VirusTotal article published on October 13, 2026 also documents a macOS infostealer using the same address as an exfiltration receiver [5].

This correlation supports the IP's involvement in malicious activity. It does not demonstrate that /d/unix45351194 belongs to the same actor, family or operation. A server can host multiple campaigns; matching hashes, analyzed samples or other data supporting shared attribution are missing.

12. Indicative MITRE ATT&CK mapping

Technique	Relationship to this case	Status
T1566.002: Spearphishing Link	Link in the recruitment email.	Observed.
T1036: Masquerading	Google branding/interface and supposed certificate.	Observed on the page.
T1027: Obfuscated Files or Information	Base64 HTML and commands.	Observed.
T1204.004: Malicious Copy and Paste	Instructions to copy and execute commands.	Prepared attempt; execution not demonstrated.
T1204.002: Malicious File	Supposed installer downloads.	Prepared attempt; execution not demonstrated.
T1059.001: PowerShell	Windows command for remote-script execution.	Delivered; execution not observed.
T1059.004: Unix Shell	mac command to start a remote file.	Delivered; execution not observed.
T1105: Ingress Tool Transfer	External software download.	Inferred intent; download not observed on my device.

This is an analytical classification, not a claim that every technique was completed [6][7][8].

13. Impact assessment and my device

These were my actions during the investigation:

• I opened the site in an incognito window.
• I entered a fictitious email address.
• I advanced to the key form and stopped before entering it or pressing Submit.
• I left the offered payloads undownloaded and unexecuted.
• I used DevTools to inspect the DOM, HTTP requests and JavaScript.

Within that scope, there is no evidence of payload execution. The page could still receive ordinary browsing data: public IP, browser, language or the fictitious address if collected or transmitted. That does not establish control of the device.

Closing the page, reviewing downloads, updating the browser and checking for unexpected permissions are reasonable steps. The described actions do not justify asserting infection or recommending a system wipe. Incognito is not a security sandbox: it limits use of ordinary browser sessions, but does not isolate command execution.

If someone did execute a command or installer, the risk changes. They should stop sensitive tasks on that system, isolate it from the network where feasible, preserve evidence and consult an incident-response professional. Credentials should be secured from another trusted device.

14. Defensive recommendations for developers and candidates

1. Check the hyperlink's actual destination as well as its visible text.
2. Treat onboarding that demands “certificate” installation through PowerShell, Terminal or unverified downloads as suspicious.
3. Compare the visible domain with the embedded document and the domains in Network.
4. Be cautious when access to the project brief depends on a local update.
5. Verify the employer and its infrastructure before entering credentials or tokens into external forms.
6. Prefer static analysis or isolated environments for investigation. Do not execute decoded commands or payloads.
7. Preserve the original email, URLs, screenshots, date, code and hashes for an abuse report.
8. Protect credentials, cookies, candidate addresses and sensitive header data before publishing evidence.

For security teams, the combination of Google Sites with external iframes, payload-configuration APIs and PowerShell or Unix copying instructions deserves attention. That does not justify blocking all Google Sites or every benign use of Base64.

15. Where to report the campaign and what to send

These are reporting channels, not a claim that I have already filed reports or obtained takedowns.

Priority A. Google Safe Browsing and Google Sites

• Google Safe Browsing: phishing. Include the Sites and iframe URLs. Describe impersonation and the false security instructions [3].
• Google Safe Browsing: malware. Explain that the distributing page leads to download-and-execute instructions.
• Google Sites: Report abuse. The documented procedure uses the three-dot menu and “Report abuse” [9]. It does not require completing the form. Avoid reopening the suspicious site merely to test its flow.

Priority B. WordPress Jobs

• Official WordPress Jobs feedback form. Include the title, exact listing URL, sender, follow-up email and misleading-link evidence. Request review and removal where appropriate [1][2].

Priority C. Detection and malware-distribution reporting networks

• Microsoft Defender SmartScreen. Select phishing or malware and provide the entry and iframe URLs with a summary [10].
• URLhaus. It accepts URLs that directly serve malware payloads, not every phishing page. Authentication is required; check its policy and existing reports before submitting a path [11].
• IC3 / FBI. This is another channel for cyber fraud, particularly if there was impact or victims. Describe observations and avoid speculative attribution [12].

The hosting provider or registrar may also be notified through a verifiable abuse channel. Hosting the content does not establish the provider's knowing involvement.

Evidence checklist for a report

• Original email, preferably .eml with headers. Do not publish it in full if it contains personal data.
• Screenshot of the visible link and its actual destination.
• Screenshots of the form and GET /api/commands?land_id=32.
• JSON containing all four fields, handled as potentially dangerous evidence.
• Obfuscated HTML/JavaScript and SHA-256. Share it privately with the abuse team instead of publishing an executable file.
• IOCs, explanation of the fake update and analysis limitations.

Abuse-report template in English

Indicators in this public version are also defanged. An abuse team may need the originals sent through its private channel.

Subject: Phishing / ClickFix malware distribution impersonating Google Workspace via a WordPress job offer

I received a follow-up email from famewunozeno01@gmail[.]com concerning the public WordPress Jobs listing “WordPress Developer (Project, Remote)” (NovenzaDigital, posted October 31, 2026). The email displayed workspace.google.com, but the actual hyperlink pointed to sites.google[.]com/view/loop-join/workspace. The page embeds lokolutikov[.]xyz/workspace1.html, which impersonates Google Workspace, asks for an email and an access key, and contacts /api/commands?land_id=32. The API response supplies platform-specific download links and Base64-encoded commands. Static analysis of the page shows that, after successful key verification, it deliberately displays a fake authentication/certificate error and prompts users to download software or paste commands into PowerShell/Terminal. I did not execute the payloads. Please investigate the URLs and associated content. Screenshots, source hashes and the observed JSON are available as evidence.

16. Limitations, attribution and open questions

• The analysis did not include complete SMTP headers: SPF, DKIM, DMARC and the server chain remain unverified.
• I do not know who controls the Gmail account, listing or domains. The shared address links the listing and email, but does not identify an individual.
• The response to data.success comes from HTML. I did not activate that stage on the live site.
• The /api/verify backend and download endpoints were not internally audited. The code may have changed since capture.
• Because the payloads were neither downloaded nor executed, there are no hashes for those files or malware-family diagnoses.
• The IP overlap with VirusTotal is infrastructure correlation. It does not prove that both campaigns are one operation.
• The evidence cannot link this case to North Korean operations, APT groups, a nationality or senders of other suspicious messages mentioned during the investigation.

17. Conclusion

The documented chain starts with a real application and continues through a follow-up email, a Google impersonation interface, an external iframe and access-key verification. According to the code, the fake expired certificate then appears and installers or commands are offered for the user to execute.

The HTML and JSON support classifying this attempt as social engineering consistent with ClickFix. The conclusion about my device is narrower: I observed no evidence of execution and stopped before entering the key or downloading files.

This case let me apply web-development knowledge to my cybersecurity studies: following an event into its iframe, inspecting an API, interpreting obfuscated JavaScript and separating observations from inferences. Legitimate hosting does not automatically make embedded content trustworthy.

My usual work as a WordPress developer explains why this lure reached me. You can find my experience and Cybersecurity Engineering studies at UVEG in my portfolio and education.

Frequently asked questions about this ClickFix attempt

What is a ClickFix attack?

It is a deception that presents a fake technical error to persuade someone to copy and execute a command as a supposed repair. In this case, the pretext was WORKSPACE_AUTH_CERT_EXPIRED, generated by the page's own JavaScript.

Am I infected if I only opened a job-offer link?

Opening a link alone does not establish infection. In this case, I found no evidence of payload execution from the described actions. That does not guarantee every page is safe or rule out other vulnerabilities. Executing a command or installer requires a different assessment.

Can a Google Sites page impersonate Google Workspace?

Yes. Google Sites allows third-party publishing, and this page embedded a form from another domain. The legitimate hosting domain does not authenticate the organization that published the content.

Did pressing Submit execute PowerShell automatically?

In the analyzed code, Submit verified the key through the API. An accepted response started the fake-error sequence. I did not identify a native-execution call from that button; the later flow requested manual action.

Does incognito mode protect me from ClickFix?

Incognito limits local browser-session persistence. It does not isolate PowerShell, Terminal or an installer you execute. Static methods or an isolated environment prepared for investigation are more appropriate for analysis.

References and verifiable sources

1. WordPress Jobs: WordPress Developer (Project, Remote). Listing, date, stated company and application email documented in the November 5, 2026 report. The listing may change or be removed.
2. WordPress Jobs: FAQ. Moderation and contact.
3. Google Search Central: Report Spam, Phishing, or Malware. Reporting mechanisms.
4. URLhaus: host 109.238.87[.]111. History of other malware-associated URLs; this links to the analysis platform, not the suspicious server.
5. VirusTotal: Introducing macOS Mirage, October 13, 2026. Cites the same IP as an exfiltration receiver in another case. It does not analyze this campaign's file.
6. MITRE ATT&CK: T1566.002. Link-based phishing.
7. MITRE ATT&CK: T1027. Obfuscation and encoding.
8. MITRE ATT&CK: T1204.004. Malicious copy and paste.
9. Google Sites: Report abuse. Reporting procedure.
10. Microsoft Defender: Report unsafe site. Phishing and malware reports.
11. URLhaus: policy and API. Submission criteria and authentication.
12. FBI: Spoofing and Phishing. Scam types and IC3 portal.

Editorial note: All six screenshots come from the described investigation. The recipient's personal details were hidden in the original screenshot; for this article I also blurred and covered the email's access code. The sender is retained as an observable without attributing its identity to a particular person. The report's limitations remain intact and suspicious indicators appear without active links.

https://fernandoperalta.xyz/blog/fake-wordpress-job-clickfix-attack/