Evolution of ClickFix Techniques
The ClickFix technique has become one of the most prevalent cyberattack methods since its emergence in 2024, evolving to encompass a wide family of sub-methods such as FileFix, InstallFix, and TerminalFix. According to data from Push Security, these attacks accounted for 67% of total security detections by August 2026, surpassing traditional phishing methods such as AiTM.
Artificial Intelligence as a Lure
Attackers are currently exploiting users' enthusiasm for generative AI (GenAI) tools to launch their attacks. This strategy relies on two facts: first, employees' habit of copying installation commands from web pages directly into the terminal interface; and second, the increasing reliance on search engines to access AI tools instead of visiting their official websites directly.
Innovative Attack Mechanisms
- InstallFix: Attackers create fake installation pages that mimic popular tools like Claude Code. When clicking the "Copy" button, the real code command is replaced with a malicious one that executes a script directly in memory without the need to save files to the disk, making detection difficult.
- LLMshare: Exploiting sharing features on platforms such as ChatGPT and Claude. Attackers create chats or "Artifacts" containing malicious links, granting them high reliability due to being hosted on the official platform domains.
- Custom GPTs: Using customized GPT models that interact with the user as if they were technical support service, ultimately directing them to external pages containing malicious payloads.
Why Traditional Defenses Fail
ClickFix attacks succeed in bypassing security systems for several fundamental reasons:
- Bypassing Email Gateways: Most of these attacks begin via search engines or deceptive advertisements, away from email scanning.
- Using Legitimate Infrastructure: Attackers rely on trusted or compromised websites, using techniques like EtherHiding to store attack configurations in smart contracts on the blockchain, making server takedowns impossible.
- In-Memory Execution: Since commands are executed in a legitimate command-line interface, they do not trigger alerts from traditional antivirus software that look for specific patterns of suspicious activity.
What This Means for Users
These attacks prove that traditional security awareness is no longer sufficient. Users are no longer safe simply by being on a trusted website or using a well-known AI tool. Relying on "copy and pasting" installation commands from the web represents a critical security vulnerability, as attackers can manipulate what the user actually copies to the device's clipboard, making the verification of commands before execution a vital technical necessity.