“Through Q2 2026, ClickFix made up an average of 52% of Push's detections, overtaking AiTM and device code phishing for the first time, and in August that figure reached 67%.”
Scale and momentum: Push and Microsoft data
Two sets of data in 2026 paint the scale of a single technique’s rise. Push's detections show ClickFix accounting for an average of 52% of its interceptions through Q2 2026, rising to 67% in August. Microsoft’s 2026 Digital Defense Report documented similarly steep growth: ClickFix-style attacks grew roughly 23× between December 2025 and May 2026, and between February and early May Microsoft Defender observed attacker-supplied commands executed on more than 1.1 million unique devices.
Microsoft described ClickFix as “one of the most conversion-efficient initial access techniques,” reporting that 96.3% of ClickFix intrusions led to malware. Push’s telemetry adds context about delivery: across browser-based attacks it intercepts, half arrive through channels other than email, and 4 in 5 ClickFix pages intercepted in 2026 were reached from search engines via compromised sites, malvertising, and SEO poisoning.
InstallFix: cloned installers, clipboard tricks, and cloaking
Push first documented InstallFix in March 2026. The pattern is straightforward and effective: attackers clone legitimate install pages for tools such as Claude Code, Codex, and NotebookLM, replace the genuine install command with a malicious one, and drive victims to those pages via search ads and redirects.
Push analyzed a cluster in which a Google search for “claude mac” returned a sponsored result that displayed bing.com as its domain. The ad routed the visitor through Bing’s click-tracking redirect to a compromised retail website, which forwarded them to a fake “Download Claude” page. Multiple cloaking layers — a server-side referrer check on the compromised site and a script on the fake page — supply a benign page or 404 to anyone who didn’t arrive via the ad.
The lure itself is engineered to fool both human users and controls: the fake page displays the genuine Anthropic install command, but its copy button places a different, malicious command on the clipboard. That command prints a legitimate claude.ai URL in the Terminal, then decodes a hidden URL and pipes a downloaded script straight into the shell without saving it to disk, creating the appearance of legitimacy to anyone watching the Terminal.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleLLMshare and custom GPTs: hosting lures on AI platforms
Push reported LLMshare in May 2026: attackers abuse sharing features on ChatGPT and Claude to host malicious install instructions or links to fake download pages. Because these lures are hosted on chatgpt.com or claude.ai, simple URL-reputation tools can be misled.
Push documented a newer escalation using custom GPTs. In the observed example, a custom GPT replied to virtually any input with a fake “Service Availability Notice” linking to a Google Sites page that served a Windows ClickFix payload; that custom GPT had more than 10,000 conversations when Push observed it. ANY.RUN’s public sandbox mapping between April 15 and October 5, 2026, linked 1,258 analyses to fake AI tool campaigns; 81% of those impersonated Claude, ChatGPT, or Codex.
Campaign structure matters: at least 45% of the ANY.RUN-linked analyses came from campaigns that told victims to paste a command (via fake CLI install pages or fake download pages), and roughly a quarter began on a shared AI chat or artifact.
Why ClickFix slips past email, reputation, and endpoint controls
ClickFix leverages habits and architectural blind spots. Push notes two workforce habits that attackers exploit: people increasingly paste terminal install commands copied from web pages, and many users reach AI tools via search rather than direct links. Email gateways never see pages reached through search results, and URL-reputation systems frequently encounter trusted domains or services in the chain — bing.com, chatgpt.com, sites.google.com, or legitimate websites that have been compromised.
Attackers also use technical evasions: Push documented EtherHiding, a tactic that stores configuration in a smart contract on a public blockchain so there is no single server to takedown and payload URLs can be swapped with a single transaction. Endpoint defenses are challenged because the malicious command executes in a legitimate shell and often runs in memory without producing files for sandboxes to analyze. Push observed 84 command forms across more than 20 binaries, frequently obfuscated to defeat string matching; and for BYOD, contractor machines, Macs, and developer workstations where EDR may be absent or tuned down, protections may be missing entirely.
Investigation is made harder by conditional delivery: Push’s ConsentFix campaign from December 2025, tied to APT29, only served its lure to visitors who entered an email from the attacker’s target list, and compromised sites shared an IP block list so the lure would not reappear for an IP once served. By the time an analyst examines a URL, it may load clean for many users.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: watch for search-ad delivery chains, clipboard-replacement behaviors, and lures hosted on trusted AI domains or Google Sites; Push’s trial at a financial services firm (≈4,500 employees) detected 6 ClickFix and 10 AiTM attacks that the existing stack missed.
- Procurement and IT leaders: the growth of tool installs pasted from the terminal and employees searching for AI tools rather than visiting known vendor pages increases exposure to SEO-poisoning and malvertising; faster adoption of AI apps can outpace approval processes.
- End users and operators: campaigns instructing users to paste commands — InstallFix variants — and conversational lures on shared chats and custom GPTs are central to the observed attacks; users pasting terminal commands and following search results are exactly the behaviors attackers design for.
ClickFix is no longer an obscure trick; the telemetry from Push, Microsoft, and public sandboxes shows it as an engine of initial access across browsers, search ads, AI platforms, compromised sites, and even blocklists written on-chain. The question left by the record is how detection and procurement practices will catch up to the simplicity and persistence of the lures — and how rapidly toolkits that copy successful features will widen the footprint yet again.
