ClickFix attacks surge across Windows and macOS
Original: ClickFix attacks infecting PCs and Macs are going viral
Why This Matters
ClickFix lowers attacker costs while raising the bar for user defense, making it a scalable threat for any malware campaign.
ClickFix, a social-engineering attack using fake CAPTCHA prompts to trick users into pasting malicious terminal commands, has gone mainstream in 2026. It now targets both Windows and macOS users across compromised legitimate websites, with even Kremlin-backed groups adopting the technique.
ClickFix was once considered a niche threat. Not anymore. The attack method—fake CAPTCHA overlay on a compromised site, followed by instructions to paste a single command into PowerShell, Windows Run, or macOS Terminal—has become the malware delivery method of choice across the threat landscape.
Researcher Kevin Beaumont noted this week that Reddit is filling with posts from victims infected via ClickFix, with legitimate websites being compromised en masse to serve the fake prompts. Kremlin-backed hacking groups have also adopted the technique.
The reason it works is partly a UX problem of the internet's own making. Years of impossible-to-close pop-ups, endless CAPTCHA image grids, and constantly shifting interfaces have trained casual users to follow absurd-looking instructions without hesitation. ClickFix exploits that learned compliance directly.
Security firm BlueVoyant noted that prior to ClickFix, attackers needed expensive infrastructure: SEO-manipulated download portals, Microsoft-trusted signing certificates, and rotating domains for MSI package delivery. 'The pivot to ClickFix in late May 2026 eliminates the code-signing requirement entirely,' BlueVoyant wrote, replacing installer legitimacy with something harder to defend against—a user voluntarily running the command themselves.
The threat extends beyond Windows. Both Jamf and independent researchers have documented macOS ClickFix variants capable of bypassing Gatekeeper protections, widening the victim pool considerably.