ClickFix Malware Campaigns: How Social Engineering Is Replacing Exploitation

For decades, cybercriminals poured resources into finding software flaws, building exploit chains, and slipping past security controls. That work has grown expensive. Modern endpoint protection, browser sandboxing, application isolation, exploit mitigations, and fast patching have all raised the cost of a successful exploit. Faced with harder targets, many attackers have turned to a simpler idea: get the victim to run the malicious command for them.

That idea drives the rapid spread of ClickFix, one of the most widely discussed attack techniques among incident responders and threat intelligence teams in 2026. Instead of exploiting a software bug, a ClickFix attack convinces a user to launch malicious PowerShell, CMD, Terminal, Bash, or shell commands while believing they are solving a technical problem, passing a security check, or unlocking content they want.

The approach works because it turns the victim into the delivery mechanism. Security tools built to spot suspicious exploitation tend to struggle when the harmful activity comes from legitimate administrative utilities, run by an authorized user who chose to run them.

What ClickFix actually is

ClickFix is not a particular malware family. It is a social engineering framework for delivering malware through manual user execution. The sequence usually starts when someone lands on a compromised website, a malicious advertisement, a phishing page, a fake software portal, or a counterfeit login screen. Rather than attacking the browser, the page shows what looks like a routine notification.

The pretexts are familiar by now. A visitor might be told that a browser update is required, that a security verification failed, that a CAPTCHA did not validate, or that a cloud document cannot be opened. Other lures imitate a video codec installation, a Microsoft Teams troubleshooting step, GitHub repository setup instructions, or a corporate VPN security check. In each case the victim is directed to copy a command and run it in PowerShell, Command Prompt, Terminal, or the Run dialog to “fix” the issue. From their point of view they are resolving a glitch. In reality they are starting the infection.

The typical attack chain

A modern ClickFix campaign tends to follow a predictable path. The user visits a compromised or malicious site, which presents a convincing error message or verification request. Following the on-screen instructions, the victim pastes a command into the Run dialog or a PowerShell console. That command quietly reaches out to attacker-controlled infrastructure and downloads a second-stage payload. From there the malware establishes persistence, pulls down additional modules, and begins the operator’s real objective, whether that is credential theft, remote access, surveillance, or ransomware staging.

What separates this from a classic drive-by download is that the browser may never be exploited at all. Because the user launches the code by hand, the activity sidesteps many protections designed to catch unauthorized execution.

Why it works so well

The technique’s power comes from its abuse of trust. Users have been trained to fix technical issues by following instructions on a screen, and many organizations actively encourage employees to run troubleshooting commands supplied by vendors, administrators, or support teams. Attackers simply present commands that look legitimate but carry hidden behavior.

A command might appear to run a harmless network diagnostic while quietly fetching a remote script, or pose as a browser repair tool while establishing persistence and pulling down further payloads. Because PowerShell, CMD, Terminal, Bash, Curl, Wget, and similar utilities are genuine parts of the operating system, their use often looks normal to security products unless deeper behavioral analysis is in place.

The most effective intrusion path is often not a flaw in software, but a vulnerability in human trust.

The anatomy of a payload

Most ClickFix payloads are deliberately small and heavily obfuscated. A representative PowerShell command will often hide its execution window, bypass execution policies, download a remote script, decode Base64 content, run a memory-resident payload, and open encrypted communications back to its operator. Many campaigns avoid writing malware to disk at all, instead using reflective loading so the code runs entirely in memory.

To do this, attackers lean on built-in tools such as PowerShell, Windows Script Host, MSHTA, Rundll32, Regsvr32, Curl, Bitsadmin, WMI, and Scheduled Tasks. These are the classic “Living Off The Land” binaries: legitimate components repurposed for malicious ends, which is exactly what makes them hard to flag.

The MITRE ATT&CK techniques observed across these campaigns map closely to that behavior:

What gets delivered

Infostealers

Credential theft families are the most common payloads. Recent campaigns have distributed Lumma Stealer, StealC, RedLine derivatives, Atomic Stealer (AMOS), and Rhadamanthys. These tools go after browser passwords, session cookies, authentication tokens, cryptocurrency wallets, VPN credentials, stored SSH keys, and cloud service logins. The theft of session tokens is especially dangerous, because hijacking an active session can let an attacker bypass multifactor authentication entirely.

Remote access trojans

Many campaigns deploy RATs for durable control, including NetSupport RAT, AsyncRAT, Remcos, DarkGate, and QuasarRAT. Once installed, these let operators watch the system, capture screenshots, log keystrokes, exfiltrate files, and move laterally across a network.

Ransomware operations

A growing number of ransomware affiliates now use ClickFix during initial access. Instead of exploit kits or malicious attachments, operators use fake verification pages to trick employees into running commands that establish a foothold. That first payload frequently pulls down Cobalt Strike beacons, Havoc implants, Sliver frameworks, or custom loaders, which later enable ransomware deployment across the environment.

Developers have become a prime target

One of the clearest trends of 2026 is the focus on software developers. Attackers disguise ClickFix instructions as ordinary development tasks: GitHub repository setup, Visual Studio Code configuration fixes, Docker troubleshooting, NPM package installation, Python environment repair, or configuration updates for AI coding assistants. Because developers routinely run terminal commands copied from documentation, malicious instructions do not always stand out.

Recent campaigns have specifically targeted users of GitHub, VS Code, Cursor, Claude Code, Gemini CLI, and Docker environments. In several cases attackers embedded malicious setup steps inside compromised repositories, producing an unusually convincing infection chain. Researchers have also documented lookalike landing pages impersonating AI coding tools, hosted on trusted infrastructure such as Google Sites to slip past web filters that automatically trust the domain.

macOS is no longer immune

ClickFix began as a Windows problem, but attackers have moved quickly to macOS. Recent campaigns direct Mac users to open Terminal and run commands built around Curl, Bash, Zsh, or AppleScript, frequently delivering credential stealers, remote access implants, or cryptocurrency wallet theft tools. The popularity of macOS among developers has made it an attractive target, and researchers have tracked Atomic macOS Stealer (AMOS) spreading through fake software updates, bogus developer tools, and ClickFix-style verification pages. Apple added a mitigation in 2026 to blunt these attacks, and operators responded with new variants, underscoring how fast the technique adapts.

Why traditional controls struggle

Conventional defenses were largely built to detect malicious files or exploitation activity, and ClickFix breaks those assumptions at every step. The browser stays uncompromised, no vulnerability is exploited, the user launches the attack by hand, the command relies on legitimate administrative tools, and the malware may run entirely in memory. Organizations leaning only on signature-based antivirus or basic web filtering can have real difficulty catching the initial compromise.

Closing that gap calls for behavioral monitoring, command-line visibility, PowerShell logging, broad endpoint telemetry, and ongoing user awareness training. Practical detection often correlates signals such as an elevated PowerShell session opening shortly after an interactive logon, suspicious child processes like mshta.exe or rundll32.exe, and clipboard paste activity immediately followed by script execution.

The growing role of file-based security

Many ClickFix infections eventually fetch second-stage payloads hidden inside archives, documents, scripts, installers, or compressed containers. These files often carry active content, embedded scripts, macros, malicious links, or obfuscated code intended to evade detection. That pattern points to the value of file-focused controls that inspect and sanitize content before it executes.

Tools in this category, such as CyberQuay’s FileDNA, analyze downloaded files, identify embedded active content, strip out potentially malicious components, rebuild clean versions of the original files, and produce detailed forensic reports. By neutralizing harmful content before it reaches the endpoint, an organization reduces the chance that a single ClickFix interaction turns into full malware deployment.

As attackers rely more on legitimate system tools and social engineering than on software exploits, the industry is seeing a genuine shift in methodology. ClickFix shows that the easiest way in is frequently through human trust rather than a software bug, and the continued growth of these campaigns suggests that execution techniques driven by social engineering will stay a dominant threat for both enterprise and consumer environments in the years ahead.