Loading story…
Security researchers report that ClickFix has become a major initial-access technique, relying on social engineering rather than software exploits to trick users into pasting attacker-provided commands into Windows Run or macOS Terminal. ESET said detections rose 108% from H2 2025 to H1 2026, while RH-ISAC described a broader 517% increase from late 2024 into the first half of 2025 and noted that Microsoft saw the method in 47% of initial-access cases handled by Defender Experts. Attackers have expanded ClickFix beyond Windows to macOS, delivered it through compromised WordPress sites, and improved lures with fake BSOD screens, frozen document viewers, and service-specific error messages.
The technique is now used by both cybercriminals and state-backed groups, with RH-ISAC linking adoption to Sandworm, APT28, MuddyWater, and Kimsuky and citing Sandworm activity against organizations in Ukraine, including at least one compromise involving FreakyPoll malware. Researchers also observed ClickFix delivering malware such as ACR Stealer, OkoBot, TELEPUZ, ClickLock Stealer, and DriveSurge, while newer variants including CrashFix, FileFix, PromptFix, and ConsentFix show continued evolution. ESET additionally identified an "AI-fix" variant that abuses legitimate domains tied to Anthropic Artifact, OpenAI Canvas, and Microsoft Copilot Pages to display fake troubleshooting content for nonexistent AI problems, underscoring how attackers are blending trusted platforms, AI branding, and increasingly industrialized delivery infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
RH-ISAC reported that ClickFix infrastructure evolved toward API-driven delivery, orchestrator commands, and AMSI-evasion techniques, while underground kits lowered the barrier to entry. The report also highlighted newer variants including CrashFix, FileFix, PromptFix, and ConsentFix.
RH-ISAC reported that nation-state actors adopted ClickFix, including Sandworm, which used the technique against sensitive organizations in Ukraine. At least one resulting compromise involved FreakyPoll malware.
Researchers observed a 517% increase in ClickFix activity from late 2024 into the first half of 2025, reflecting its rapid growth as a social-engineering-based malware delivery technique. Microsoft also reported seeing ClickFix in 47% of initial-access cases handled by Defender Experts during this period.
A Medium article published on July 16, 2026 by researcher Ddosier proposed detecting ClickFix through a shared behavioral sequence: browser focus loss, shell interpreter execution, and outbound network activity within 60 seconds. The article mapped this invariant across Windows, macOS, and Linux and included example detections in KQL, Splunk SPL, and YARA-L.
ESET tracked an "AI-fix" ClickFix variant that used legitimate domains including Anthropic Artifact pages, OpenAI Canvas, and Microsoft Copilot Pages. The pages displayed fake troubleshooting content for nonexistent generative AI issues to trick users into executing attacker-supplied actions.
ESET reported that ClickFix expanded beyond Windows to target macOS. The campaign also used compromised WordPress sites and deceptive screens such as fake BSODs, frozen document viewers, and service-specific error messages.
ESET's H1 2026 threat reporting said ClickFix detections increased 108% compared with H2 2025. The growth was tied to attackers expanding into new environments and refining their social-engineering lures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcerhisac.org
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Jul 1, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026