Executive Summary
In the last two years, ClickFix tactics have moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses. The technique first appeared in late 2023 and early 2024, and it skips exploits and vulnerabilities entirely as a fake webpage impersonating a CAPTCHA check, browser update notice, or meeting error instructs a visitor to open the Windows Run dialog or macOS Terminal, paste a command, and press Enter.
ESET measured a 517% jump in ClickFix activity from late 2024 into the first half of 2025, and Microsoft’s 2025 Digital Defense Report put it at 47% of initial-access cases seen by its Defender Experts team. From March 1 to May 31, 2026, ClickFix was a top malware delivery technique globally.
Nation-State Adoption
A Russian state-backed hacking group adopted ClickFix to compromise devices belonging to sensitive organizations in Ukraine. The technique had previously been used primarily by financially motivated criminals. Ukraine’s CERT confirmed that Sandworm, an advanced hacking unit inside Russia’s GRU military intelligence arm, has been using the technique since spring, resulting in the network compromise of at least one organization infected by FreakyPoll, one of Sandworm’s custom malware packages.
Proofpoint has also tied state-backed groups from Russia, Iran, and North Korea – including APT28, MuddyWater, and Kimsuky to campaigns that dropped ClickFix into their existing infection chains, and North Korean crews built a fake-job “ClickFake Interview” version to hit cryptocurrency workers in early July 2026.
New Malware Families and Campaigns
ACR Stealer
ACR Stealer, in circulation since 2024, walks out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders.
In some cases, secondary loaders query public blockchain RPC services and Web3 infrastructure for command-and-control resolution, a dead-drop technique known as EtherHiding.
OkoBot
Kaspersky identified the OktoBot campaign in January 2026 and found a four-stage operation containing more than 20 malicious payloads and implants Windows users managing cryptocurrency are being targeted by OkoBot malware, designed to steal wallet files, recovery phrases, passwords, and browser data while recording activity within financial applications.
Once on a machine, OkoBot disables Windows Defender notifications, opens firewall ports for Remote Desktop, creates a new remote user, and modifies a Windows system file to permit several RDP sessions, with a scheduled task named “Apple Sync” reconnecting the machine to attackers every hour.
TELEPUZ
A new modular malware named TELEPUZ has been spreading since late April 2026 via ClickFix-compromised websites, and is likely offered as a malware-as-a-service. Its C2 server can be reached through encrypted URLs from Telegram, Steam profiles, DNS queries, and Polygon blockchain smart contracts, and once connected it can perform file enumeration, keystroke logging, command execution, and cookie extraction.
ClickLock Stealer (macOS)
According to Group-IB, threat actors are actively targeting macOS users with a newly identified infostealer dubbed “ClickLock Stealer,” leveraging paste-and-run techniques to bypass Apple’s native security protections. Despite macOS defenses like Gatekeeper and SIP, ClickLock combines ClickFix-style delivery with coercive “locker” behavior to force user compliance. If the user refuses to provide credentials, the malware enforces compliance by repeatedly terminating system processes, effectively locking the interface and leaving only password prompts visible.
DriveSurge
A threat actor known as DriveSurge has been orchestrating extensive malware distribution campaigns by compromising numerous websites and employing both ClickFix and FakeUpdates techniques. Operating as an initial access broker on a pay-per-install model, it funnels visitors through a traffic distribution system that determines the most effective lure for each target.
Infrastructure Evolution
The malicious commands behind fake “prove you’re human” pages are now served by API-driven servers that give each visitor the same malware in a different disguise, and a new delivery method has been built to slip past Windows’ script scanning. Newer pages quietly download a file to the victim’s Downloads folder, while the clipboard receives only a short “orchestrator” command that moves, unpacks, and runs the script, keeping the actual payload off to the side to evade AMSI scanning.
Complete ClickFix kits sell on underground forums for $250 per month to $1,800 for a lifetime license, with software updates included. This structure means ClickFix campaigns can be launched by individuals with no meaningful malware development capability, “the sophistication is rented, not built,” dramatically increasing campaign volume with no corresponding increase in attacker skill.
New Variants
In January 2026, researchers identified a new variant called CrashFix, which deliberately crashes the victim’s browser and then deploys a social engineering lure offering to restore it, raising compliance because the user is reacting to a browser that has genuinely stopped working. A wider family of “fix-type” attacks has also been documented: FileFix manipulates the Windows File Explorer address bar, PromptFix targets AI tooling, and ConsentFix abuses OAuth consent screens to hijack accounts.
While ClickFix has historically targeted Windows users, researchers recently observed its delivery of Atomic Stealer malware on macOS systems, leading experts to warn that “macOS must no longer be treated as lower risk.”
Defense Recommendations
- Remove the Run prompt via GPO and block mshta.exe through AppLocker or WDAC.
- PowerShell Constrained Language Mode limits what a script can do even when someone launches it directly, and Windows Defender Application Control or AppLocker keeps living-off-the-land binaries from running outside their normal context.
- Train both Windows and macOS users never to paste commands in Run, Terminal, or Script Editor, and include ClickFix lures in security awareness training, showing users simulated pop-up and email-based lures that mimic real attacks.
- On a suspected host, isolate, rotate credentials, revoke tokens, and check outbound connections to remote shares and image-hosting services.
