ClickFix Social Engineering Expands to Browser JavaScript and Terminal Paste Attacks

Threat actors are expanding ClickFix-style social engineering beyond simple “copy/paste this command” lures, including a campaign that abuses Pastebin comments to push victims toward executing attacker-supplied JavaScript in their browser to hijack cryptocurrency swap flows. The Pastebin comments promote a fake “Swapzone.io arbitrage exploit” and route users through a rawtext[.]host link to a Google Doc (“Swapzone.io – ChangeNOW Profit Method”) that instructs users to run JavaScript which can modify the swap process in-session and redirect funds to attacker-controlled wallets; the reporting notes this may be an early example of ClickFix being used to directly alter webpage functionality for theft.

Separately, Objective-See documented ClickFix as a rapidly growing infection technique on macOS and Windows that relies on persuading users to paste attacker-controlled commands into a terminal, enabling execution without exploiting software vulnerabilities and potentially bypassing macOS protections such as Gatekeeper and Notarization. The post describes a practical macOS-focused mitigation that intervenes at “paste time” to disrupt many ClickFix attempts, implemented in BlockBlock, while also outlining limitations and potential bypasses—reinforcing that ClickFix is primarily a user-manipulation problem that defenders should address with both technical controls and user-execution friction.