ClickFix is a social engineering technique. It typically shows a popup over a webpage instructing the viewer to run a system command that will install malware. It often contains an instruction to open the Run dialog on Microsoft Windows using the shortcut.
History The first ClickFix version was discovered in October 2023.
In March 2026, Apple added a mitigation to macOS to prevent ClickFix style attacks. In April, a modified variant using the applescript:// URI scheme to bypass the use of the Terminal application was found.
According to Hudson Rock, ClickFix often forms a feedback loop, using credentials stolen by infostealers to compromise administrative accounts on legitimate websites and host new ClickFix lures. In July 2026, researchers detailed an incident where stolen WordPress credentials led to a ClickFix campaign on an Artlist subdomain using Polygon smart contracts (EtherHiding) for dynamic payload routing.
Usage ClickFix was used in the 2026 ransomware attack on Berlin.
See also
Trojan horse (computing) Virus hoax
References
Further reading
External links ClickFix Campaign Monitor v1.0