The Most Successful Attack of 2026 Doesn't Exploit Anything. It Asks Nicely.

No zero-day. No exploit. No malicious attachment. Just a box on a web page that says “prove you're human,” and a user who does exactly what it says.

That's ClickFix, and Ars Technica is now calling it viral. They're right. I've been watching this technique creep up in incident-response engagements for two years, and at this point it isn't a trend. It's the front door.

What it actually is

You land on a page. Maybe it's a compromised WordPress site, maybe a malicious ad, maybe a fake Google Meet or Cloudflare error. A pop-up says something's broken and offers to fix it. Click here to verify. Click here to repair your browser. Click here to free up disk space.

The “fix” is a set of instructions. Press Windows+R. Press Ctrl+V. Press Enter. On a Mac, open Terminal and paste this command.

That's it. The user pastes a command the page silently copied to their clipboard, and the machine runs it. PowerShell reaches out, pulls a payload, executes it in memory. On macOS, a Base64 blob decodes into a script that curls down a stealer. Recorded Future's breakdown calls it a four-stage pattern: obfuscated input, native execution, remote ingress, in-memory execution. Nothing touches disk that a scanner would flag. Nothing gets past Gatekeeper because Gatekeeper was never asked.

The victim did the work. The attacker just wrote good instructions.

The numbers are ugly

This isn't a niche trick anymore. ESET tracked a 517% jump in ClickFix activity from late 2024 through the first half of 2025. Microsoft's Defender Experts team said ClickFix accounted for 47% of the initial-access cases they handled in 2025. Nearly half. Expel estimated one ClearFake variant alone hit as many as 147,000 systems.

And it's not just criminals. Proofpoint has tied APT28, MuddyWater and Kimsuky to ClickFix campaigns. Sandworm started using it against Ukrainian targets this spring. North Korean crews run a “ClickFake Interview” version aimed at crypto workers. When the GRU and a $250-a-month toolkit vendor are running the same play, that tells you something about how well it works.

The toolkits are the part that should register. ClickFix kits sell for $250 a month or $1,800 for a lifetime license with updates. That's a product with a roadmap.

Macs are in the blast radius now

For years the Mac crowd got to shrug at this stuff. Not anymore.

Microsoft documented a macOS campaign running January through May this year that dropped the .dmg entirely. Fake “how to clean up your Mac” tutorials posted on Medium and Squarespace walk users through pasting a Terminal command. The command fingerprints the machine, checks the keyboard layout (Russian layouts get a kill switch, which tells you where the operators live), then delivers MacSync, Shub Stealer or AMOS. Those pull Keychain entries, iCloud data, browser passwords and crypto wallets. One variant swaps the real Ledger Wallet app for a trojanized copy.

Apple shipped a mitigation in macOS 26.4 that warns you before pasting into Terminal. Within weeks attackers were routing around it with the applescript:// URI scheme. Right instinct from Apple. Didn't hold.

Why it keeps working

Most of the industry's answer to ClickFix is “user awareness training.” I've sat through enough of those sessions to tell you they don't move the needle on this one, and it's not because users are dumb.

It works because the instructions look exactly like the legitimate ones. Every IT department on earth has told a user “open a terminal and paste this” at some point. Every developer has copied a command off Stack Overflow without reading it. Every Cloudflare challenge and Google CAPTCHA has trained people that a small ritual gets you past the gate. ClickFix didn't invent a new behaviour. It borrowed one we spent twenty years normalizing.

The people falling for this aren't the ones who ignore training. They're the ones who follow instructions.

It's evolving faster than the defences

Cisco Talos just published two new twists that show where this is heading.

One campaign doesn't even leave the browser. Victims paste JavaScript into the Chrome address bar or install it as a Tampermonkey script. The code hooks the fetch API and swaps crypto deposit addresses on the fly. Command and control runs through a Google Sheet, with the payload hidden as white text on a white background. Try writing a firewall rule for docs.google.com.

The other one stores its payload in a smart contract on BNB Smart Chain, pushes a fake CAPTCHA through a Cloudflare Worker, and executes a disguised DLL over WebDAV via rundll32. The same actor drops Amatera, an infostealer with more than 400 collection targets covering browsers, Signal, Telegram, KeePass, Bitwarden, 1Password, authenticator apps and a hundred-plus desktop wallets.

Meanwhile a researcher who pulled apart 3,000 live payloads found the backend serving custom-built payloads on demand with rotating encryption. Attackers have also moved from the Windows Run box to Windows Terminal, because Run leaves a registry trail and Terminal doesn't. They read the forensics playbooks too.

What to actually do about it

I'll keep this short because the fix isn't complicated. It's just unpopular.

Take the Run dialog away. Most users have never needed Windows+R and never will. A group policy kills it. Same thinking for Terminal on managed Macs: if a user's job doesn't require a shell, MDM can remove it.

Put PowerShell in Constrained Language Mode and turn on AppLocker or WDAC. A ClickFix command that can't spawn an interpreter is a command that pastes and does nothing.

Alert on the sequence, not the file. On Windows that's explorer spawning PowerShell with an encoded command that reaches out to the internet. On macOS it's curl piped through base64 and into osascript. Your EDR can see this. Someone has to have written the rule and someone has to be looking at the alert.

Watch for docs.google.com and other trusted-service traffic coming from processes that have no business talking to them. That's Talos's advice and it's good.

And yes, tell people. But tell them one specific thing, not a slide deck: no legitimate website will ever ask you to paste a command into Run or Terminal. Ever. That's the whole lesson. One sentence. Put it on a sticker.

The honest caveat

ClickFix isn't magic. It still needs a user with local execution rights on a machine where nobody locked down the interpreters. In the environments I see that have done the boring work — application control, script restrictions, an EDR someone actually monitors — it lands and dies. The technique is loud if you're listening.

The problem is most organizations aren't listening, because they spent the budget on the phishing simulator instead.

Bottom line

We built a whole industry around stopping code from running on endpoints. Attackers responded by getting the user to run it for them. ClickFix is a social engineering attack wearing a technical costume, and if your defence is “we trained them,” you've already lost the ones who were paying attention.

Lock down the interpreters. Watch the process tree. And stop telling users to paste things into terminals unless you're prepared for them to do it for anyone who asks.

No legitimate website will ever ask you to paste a command into Run or Terminal. Ever. Put it on a sticker.