ClickFix Technique Dominates Malware Delivery, Expands to macOS
A social engineering tactic known as ClickFix has become the leading method for malware delivery, with researchers noting its expansion to macOS and targeting of developers.
In a significant shift in threat actor tactics, the social engineering technique dubbed "ClickFix" has rapidly ascended to become the dominant method for malware delivery, according to new research from ReliaQuest. What was once an emerging tactic observed in 2024 has, in just two years, become the overwhelming favorite among cybercriminals for gaining initial access and evading defenses. ClickFix primarily works by tricking targeted individuals into copying and pasting malicious commands directly into system dialogs, such as Windows Terminal or macOS's Script Editor.
Attackers employ deceptive tactics, presenting users with fake error messages or verification prompts like CAPTCHAs. These prompts contain text-based commands that, when executed by the user, initiate the malicious payload. This method is particularly effective as it bypasses many traditional security measures, including file scanning and standard email-based defenses. ReliaQuest's analysis, covering activity from March 1 to May 31, found ClickFix prevalent in both initial access and defense-evasion categories.
The technique's reach has also expanded beyond Windows. Researchers observed ClickFix activity on macOS systems for the first time, with a notable example involving the Atomic macOS Stealer (AMOS). Threat actors have adapted their approach, moving from fake software lures to using applescript:// links that automatically open macOS's built-in Script Editor to run malicious commands. This change is designed to circumvent new warnings Apple introduced in macOS 26.4 that appear when users paste commands directly into the Terminal, a warning not triggered by Script Editor.
This expansion necessitates that security teams treat macOS with the same level of vigilance as Windows. "ClickFix can no longer be handled as a special case," stated Raigridas Bartkus, cybersecurity specialist at ReliaQuest. "Training, detection, and triage for it should run continuously on both Windows and macOS." Organizations must ensure their monitoring and response capabilities cover both operating systems comprehensively.
ReliaQuest's report also highlighted ClickFix's role in defense evasion, accounting for nearly 28% of such activity during the analyzed period. This was achieved through sophisticated command and file obfuscation techniques, including the use of AI-generated obfuscation to hide malware logic under thousands of variable assignments. One specific ClickFix loader observed was designed to deliver "Deepload" malware, with its obfuscation making it difficult for defenders to develop signatures quickly.
A concerning trend identified is the targeting of developers. Malvertising campaigns, particularly those appearing as sponsored search results on Google Ads for tools like "claude code install" and "homebrew install," have been used to lure developers. These fake installation pages present error messages that instruct users to copy and paste malicious commands. In compromised instances, exposed npm and Bitbucket tokens were found on affected hosts, indicating that these attacks are successfully reaching their intended, high-risk targets.
Furthermore, ClickFix is evolving from a simple delivery mechanism into a launchpad for more complex post-exploitation activities. ReliaQuest observed instances where a single pasted command was used for domain enumeration and to establish persistent access without dropping any malware. To combat this evolving threat, ReliaQuest recommends user training on both platforms to avoid pasting commands into sensitive tools, and for organizations to consider restricting access to tools like Terminal and Script Editor for average users, while implementing robust logging and alerting for developer environments.
Defensive strategies should focus on user education and technical controls. Training employees to recognize and avoid executing commands from untrusted sources is paramount. For technical staff, blocking these essential workflow tools is often impractical; therefore, robust monitoring for anomalous sequences of activity, such as base64 decoding, curl retrievals, and PowerShell or osascript executions, becomes a critical detection mechanism.
Opera has introduced a new defense mechanism called Paste Protect, specifically designed to combat ClickFix-style attacks. This feature, enabled by default in its desktop browsers, automatically warns users and blocks malicious clipboard hijacking attempts, which were identified as a significant vector for malware delivery in 2025.
Opera has introduced a new security feature called Paste Protect, specifically designed to counter the growing threat of ClickFix attacks. These attacks rely on social engineering to trick users into pasting malicious commands into their browsers, and Opera's new feature aims to prevent the execution of such harmful inputs, thereby enhancing user safety against this evolving attack vector.
This new analysis highlights the industrialization of the ClickFix ecosystem, with complete attack kits now available for rent on underground forums, advertising AV-bypass capabilities. Researchers from Reversing Labs have developed a YARA rule targeting the HTML lure mechanism, which has proven effective in detecting ClickFix lures that evade traditional AV and EDR solutions. The evolution also includes new variants like 'CrashFix' that deliberately crash browsers before deploying lures, and broader payload diversification beyond stealers to include RATs, indicating a shift towards more persistent intrusions.