ClickFix in Q2 2026: Different Wrappers, Same Leading Infection Vector

ClickFix is a social engineering technique in which a malicious webpage persuades the user to copy a command and run it through a trusted local interface. Rather than relying on an exploit, attachment, or browser-initiated download, it shifts execution to the victim and makes the activity appear user initiated. During Q2 2026, ClickFix activity appeared in more than half of Vega customer environments. Open-source reporting showed its broader adoption by financially motivated and state-sponsored actors. One campaign combined ClickFix with EtherHiding and a Traffic Distribution System to serve lures through more than 2,000 compromised websites and deliver a remote access trojan. In another reported intrusion, ClickFix led to StealC infections, with the stolen credentials later used to deploy Qilin ransomware. Iran-linked MuddyWater and North Korea-linked Kimsuky used ClickFix as an initial access vector in espionage campaigns, while Pakistan-linked APT36 extended the technique to Linux systems.

The lure changed from campaign to campaign, but the execution mechanism remained consistent. Observed themes included fake CAPTCHA challenges, macOS update prompts, Claude-related content, browser repair instructions, and software installation workflows. In each case, the user was directed to paste a command into a trusted interface such as the Windows Run dialog, Terminal, Script Editor, or an existing shell session. On Windows, the pasted command commonly launches PowerShell or cmd.exe as a child process of explorer.exe, while the Run dialog records the command in the RunMRU registry key, providing evidence of user-driven execution. On macOS, Terminal.app typically launches zsh or bash to execute the pasted command, with commands chaining curl-based retrieval, AppleScript execution, and password validation through dscl authonly. On Linux, the same clipboard-paste technique targets bash and can be observed through Sysmon for Linux process creation events or auditd telemetry.

Post-execution behavior was more consistent than the lure itself. Across campaigns, operators performed second-stage retrieval, installed malicious browser extensions, modified antivirus exclusions, and delivered payloads through living-off-the-land binaries or DLL sideloading. The CrashFix variant abused finger.exe, a signed legacy Windows utility, to retrieve a payload while bypassing normal download controls. Lures impersonating AI development tools reconstructed download commands at runtime through character substitution, while another chain piped curl output through base64 decoding for in-memory execution. A macOS campaign delivering SHub Stealer used curl to retrieve a shell loader followed by an AppleScript payload that discovered the victim’s external IP address and displayed a counterfeit authentication prompt. ClickFix is likely to remain a prominent initial-access technique through the second half of 2026, with operators continuing to rotate lure themes and delivery infrastructure while preserving the underlying clipboard-based execution model.