Loading story…
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims.
ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
An investigation of nearly 3,000 ClickFix payloads found the technique had evolved into an API-backed malware delivery framework that generated unique obfuscated commands for each victim. The analysis also documented multilingual and platform-aware delivery plus newer execution methods intended to reduce AMSI visibility and evade clipboard-focused detections.
Security researchers warned that future ClickFix variants could become even more sophisticated, potentially executing entirely in the browser to better evade endpoint detection and response tools. The warning accompanied guidance for users not to run terminal commands copied from websites unless they fully understand them.
The attacks tricked users into pasting and executing malicious terminal commands, leading to payloads such as information-stealing malware. On Windows, the chains commonly abused living-off-the-land tools like MSHTA and PowerShell to execute the next stage.
The updated ClickFix campaigns were observed being distributed through Google Search malvertising and through legitimate websites compromised via outdated WordPress plugins or SEO poisoning. These delivery methods funneled users to fake Cloudflare-style verification pages.
Researchers documented a new wave of ClickFix attacks using embedded tutorial videos, countdown timers, and automatic operating system detection to make fake bot checks and CAPTCHA pages more convincing. The lures tailored instructions to Windows and Mac users and often used JavaScript to copy malicious commands to victims' clipboards.
By 2025, advanced ClickFix phishing infrastructure, including weaponized landing page builders, was being sold or shared to help less technical criminals run campaigns. This lowered the barrier to launching fake verification and self-infection lures at scale.
Researchers reported a 517% increase in ClickFix attacks during the first half of 2025. By that period, the technique accounted for nearly 8% of all blocked attacks, reflecting its rapid adoption by cybercriminals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcemalwarebytes.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers report that **ClickFix** has become a major initial-access technique, relying on social engineering rather than software exploits to trick users into pasting attacker-provided commands into **Windows Run** or **macOS Terminal**. ESET said detections rose **108%** from H2 2025 to H1 2026, while RH-ISAC described a broader **517%** increase from late 2024 into the first half of 2025 and noted that Microsoft saw the method in **47%** of initial-access cases handled by Defender Experts. Attackers have expanded ClickFix beyond Windows to **macOS**, delivered it through compromised **WordPress** sites, and improved lures with fake **BSOD** screens, frozen document viewers, and service-specific error messages. The technique is now used by both cybercriminals and state-backed groups, with RH-ISAC linking adoption to **Sandworm, APT28, MuddyWater, and Kimsuky** and citing Sandworm activity against organizations in Ukraine, including at least one compromise involving **FreakyPoll** malware. Researchers also observed ClickFix delivering malware such as **ACR Stealer, OkoBot, TELEPUZ, ClickLock Stealer**, and **DriveSurge**, while newer variants including **CrashFix, FileFix, PromptFix, and ConsentFix** show continued evolution. ESET additionally identified an **"AI-fix"** variant that abuses legitimate domains tied to **Anthropic Artifact**, **OpenAI Canvas**, and **Microsoft Copilot Pages** to display fake troubleshooting content for nonexistent AI problems, underscoring how attackers are blending trusted platforms, AI branding, and increasingly industrialized delivery infrastructure.
Jul 20, 2026
Cybercriminals are leveraging social engineering techniques known as ClickFix and its new variant, FileFix, to trick users into executing malicious commands on their Windows systems. The ClickFix method involves compromised websites displaying fake CAPTCHA-style pages that prompt users to "verify you are human." When users interact with these pages, malicious content is injected into their clipboard, and they are instructed to paste and run this content via the Windows Run dialog, leading to the installation of remote access tools such as NetSupport RAT. The SmartApeSG campaign is one example actively using this approach, with infection chains triggered under specific conditions on compromised sites. The FileFix variation, recently observed in the wild, shifts the attack vector by instructing users to paste malicious commands into the Windows File Explorer address bar instead of the Run dialog. This subtle change exploits user familiarity with File Explorer, making the attack less suspicious and increasing the likelihood of success. Both techniques rely on phishing emails or fake service pages to lure victims, and the end goal is typically the deployment of remote access malware. Security teams should be aware of these evolving tactics and educate users about the risks of following unsolicited instructions involving system dialogs or file paths.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026