IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE1 IOC

ClaudeFix: Shared Claude Chats Meet ClickFix

ZT
Zscaler ThreatLabz
Published July 15, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSandwormINFRASTRUCTUREunknownCAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure
Capability
Victim

Indicators of Compromise

Indicators of Compromise1

TypeIndicatorConfidenceScoreFirst Seen
SHA2560e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
file-hashintel-blogmalware
Medium
53
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph1 total IOCs
SHA256
SHA2561Actors1REPORTClaudeFix: Shared Claude CSandworm
scroll to zoom · drag to pan · click IOC to open