ClickFix social-engineering attacks spreading malware across Windows and macOS

A technique known as ClickFix has shifted from an exotic approach to a mainstream malware vector, infecting both Windows and macOS users through compromised websites. Attackers use a fake CAPTCHA overlay—often mimicking Cloudflare—to present a line of text that victims are instructed to copy and paste into a terminal window and execute.

The simplicity of the attack lowers the barrier for malware distributors. Previously, operators relied on complex infrastructure such as SEO-poisoned portals, signed Microsoft Installer packages, and rotating domains to deliver malware like the “Lorem Ipsum” family tracked by BlueVoyant. Since pivoting to ClickFix in late May 2026, attackers no longer need code-signing or installer packages; instead, they exploit user trust in terminal commands presented as routine instructions.

The technique’s reach has broadened from users specifically searching for software like Microsoft Teams to any visitor on a compromised site. Security researchers note that the attack model is now so effective that even Kremlin-backed groups have adopted it. Independent researcher Kevin Beaumont observed widespread reports on Reddit of users infecting their computers via ClickFix, with legitimate websites increasingly compromised to serve the fake CAPTCHA prompts.

macOS users are not spared. Jamf and other researchers have documented macOS variations of ClickFix that can bypass Gatekeeper protections. Attackers continue to diversify their infrastructure, abusing public services such as publicly posted Google Sheets documents and blockchain-based smart contracts to host control infrastructure. Cisco Talos and Netskope separately documented campaigns using these methods, with one campaign beaconing from 5,400 sites.

Defenders have responded with updated tools: BlockBlock can block ClickFix attacks on macOS as soon as a user presses ⌘+V, and uBlock has been updated with similar capabilities. Despite these mitigations, the core issue remains user trust in terminal commands presented in familiar contexts, a problem exacerbated by the growing complexity and friction of modern web interfaces.