ClickFix Phishing Campaign Masquerading as a Claude Installer

Rapid7 observed a small ClickFix phishing campaign impersonating a Claude installer that used multi-step payload delivery and targeted customers in the EU and US; their MDR/InsightIDR detections stopped further compromise. The feed also highlights Microsoft’s April 2026 Patch Tuesday (167 vulnerabilities, including one known exploited in the wild and one publicly disclosed, with elevated browser vulnerability counts) and Metasploit additions including an exploit module for CVE-2026-20127 (Cisco Catalyst SD‑WAN Controller authentication bypass) recently observed as exploited. Separately, Rapid7