Key Takeaways
- ClickFix has become the predominant social‑engineering method for initial access, dominating both Windows and macOS threat activity in a recent three‑month window.
- The technique tricks users into copying and pasting malicious commands into system dialogs (e.g., Windows Terminal, macOS Script Editor) by masquerading as error messages, CAPTCHAs, or software‑install prompts.
- Variants such as CrashFix, AI‑generated obfuscation loaders, and SEO‑poisoned attacks have expanded the toolkit, while attackers increasingly target developers through malvertising and emailed links.
- ClickFix now drives nearly 28 % of defense‑evasion activity observed by ReliaQuest, often using AI‑based variable‑assignment obfuscation to hide malware like Deepload and the Atomic macOS Stealer (AMOS).
- Effective defense relies on continuous user training, monitoring for anomalous command sequences (base64 decode + curl + PowerShell/osascript), and limiting—or logging—access to Run, Terminal, and Script Editor rather than outright blocking them for technical staff.
The Rise of ClickFix as Dominant Initial Access Technique
In just two years, ClickFix has evolved from a niche social‑engineering trick to the overwhelming favorite of threat actors for delivering malware. ReliaQuest’s analysis of threat activity from March 1 to May 31 showed that ClickFix dominated both the initial‑access and defense‑evasion categories during that period. The technique’s success stems from its ability to bypass traditional file‑scanning and email‑gateway defenses by convincing victims to manually execute attacker‑supplied commands. Because the payload is delivered as text rather than a downloadable file, many endpoint protections that rely on signature‑based scanning never see the malicious content, giving attackers a stealthy foothold on compromised systems.
Mechanics and Evasion Tactics of ClickFix Attacks
ClickFix operates by presenting targets with seemingly legitimate prompts—such as error dialogs, verification requests, or fake CAPTCHAs—that contain a line of text instructing the user to copy and paste a command into a system interface like Windows Terminal, the Run box, or macOS Script Editor. Once the victim complies, the command runs with the user’s privileges, often launching a downloader or directly executing malicious code. This approach sidesteps many conventional defenses because no executable file is written to disk; instead, the attack lives entirely in memory or in transient script files, making it difficult for antivirus engines to detect until after execution.
Emerging Variants: CrashFix, AI‑Powered and SEO‑Poisoned ClickFix
Over the past two years, several ClickFix variants have appeared. “CrashFix” repeatedly crashes a user’s browser and then displays a malicious command as the purported fix, exploiting frustration to drive compliance. Other variants weaponize artificial intelligence: attackers use AI‑generated text to craft convincing lures and to produce highly obfuscated loader scripts that hide malicious logic beneath thousands of benign‑looking variable assignments. Additionally, threat actors have employed search‑engine‑optimization (SEO) poisoning to push malicious advertisements to the top of search results for queries like “claude code install” or “homebrew install,” thereby increasing the chances that developers will encounter the fake installation pages.
ClickFix Crosses to macOS: Atomic Stealer and Script‑Editor Exploitation
ReliaQuest documented the first widespread use of ClickFix on macOS systems, notably involving the Atomic macOS Stealer (AMOS). Earlier macOS ClickFix attacks relied on baiting users with pirated or cracked software, but recent campaigns have shifted to using an applescript:// URI that automatically opens Script Editor—a built‑in macOS scripting application—and executes the attacker’s commands there. This change bypasses the warning introduced in macOS 26.4 that appears when users paste commands into Terminal, a warning that does not trigger in Script Editor. Consequently, security teams must now extend the same monitoring and response coverage they apply to Windows endpoints to macOS devices.
ClickFix’s Role in Defense‑Evasion and AI‑Generated Obfuscation
The ReliaQuest report highlighted that ClickFix accounted for nearly 28 % of all defense‑evasion activity observed in the three‑month window, largely due to sophisticated command‑ and file‑obfuscation techniques. One notable example is a ClickFix loader designed to deliver the “Deepload” malware. The loader likely employs AI‑generated obfuscation, burying the malware’s operational logic under a dense thicket of variable assignments that resemble routine scripting. This approach not only obscures the payload from signature‑based detectors but also accelerates the creation of new variants, shortening the window defenders have to update signatures or heuristics.
Changing Delivery Channels: Email Lures and Developer‑Focused Malvertising
While early ClickFix campaigns relied heavily on compromised websites to host the malicious lures, ReliaQuest noted a shift toward delivery via emailed links. This change may benefit defenders because email traffic passes through gateways, link‑rewriting services, and sandboxing environments that can intercept or neutralize the lure before the victim clicks. Nevertheless, attackers continue to exploit a variety of vectors. Traditional fake CAPTCHA and verification prompts remain prevalent on Windows, while macOS users encounter counterfeit software‑installation guides. Moreover, malvertising campaigns via Google Ads masquerade as legitimate developer tools—most commonly “claude code install” and “homebrew install”—directing victims to spoofed installation pages that present an error lure and instruct them to paste a malicious command.
From Payload Delivery to Modular Post‑Exploitation Launchpad
Beyond simply dropping malware, ClickFix is increasingly used as a launchpad for modular post‑exploitation activities. ReliaQuest observed instances where a single pasted command performed domain enumeration, gathered credentials, and established persistent mechanisms without ever writing a traditional malware file to disk. In several confirmed compromises, exposed npm and Bitbucket tokens were found in process environment variables on infected hosts, indicating that the attacks successfully targeted developers and harvested valuable secrets. This evolution suggests that ClickFix functions less as a one‑time delivery mechanism and more as a flexible platform for attackers to chain together reconnaissance, credential theft, and persistence steps as needed.
Defensive Guidance: Training, Monitoring, and Limited Restriction
To mitigate ClickFix threats, Bartkus recommends that organizations train all users—on both Windows and macOS—to never paste unverified commands into Run, Terminal, or Script Editor. Simulated ClickFix lures can help employees recognize the tactic in a safe environment. Technically, restricting access to those utilities can reduce risk for average employees, but for developers and technical staff such blocks would create unacceptable friction and likely be circumvented. A more effective approach is to log and alert on suspicious command sequences—such as a base64‑decode operation followed by a curl download and subsequent PowerShell or osascript execution—which represent anomalous behavior in developer environments. Continuous monitoring, combined with user awareness and granular endpoint telemetry, provides the best chance to detect and thwart ClickFix before it yields footholds or data loss.