ClickFix has never been bigger, and AI tools are its most convincing lure yet

ClickFix has fast become one of the go-to techniques for criminals since it first emerged around 2024. It’s grown in both volume and variety, with an ever-expanding family of sub-techniques like FileFix, InstallFix, TerminalFix, and the entirely browser-native ConsentFix.

The lures too have become more developed and targeted, with recent attacks preferring to target people searching for and using AI tools, a trick that is catching many users off guard and blending in with otherwise legitimate traffic for approved GenAI tools.

Push's detection data shows how far the technique has spread. Through Q2 2026, ClickFix made up an average of 52% of Push's detections, overtaking AiTM and device code phishing for the first time, and in August that figure reached 67%. 

Across all the browser-based attacks Push intercepts, 1 in 2 arrive through channels other than email, such as search engines and social media. The rest came through email but weren’t stopped at the email gateway. ClickFix goes a step further: 4 in 5 ClickFix pages intercepted in 2026 were reached from search engines — through compromised websites, malvertising, and SEO poisoning. 

AI tools are the newest lure

The latest ClickFix variants use AI tools as the bait. In Push's last quarterly snapshot, AI-themed InstallFix and LLMshare attacks made up around 5% of all attacks Push detected, a growing subset of the ClickFix family.

Other researchers are seeing the same trend. ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between April 15 and October 5, 2026, and 81% of them impersonated Claude or ChatGPT and Codex. At least 45% came from campaigns that told the victim to paste a command, through fake CLI install pages or fake download pages with ClickFix, and another quarter started on a shared AI chat or artifact.

These lures work because AI adoption has spread two habits across the workforce. The first is installing tools from the terminal. Claude Code and similar tools ship as a one-line terminal install, so people who would never previously have opened a command line now paste commands from web pages as a normal part of trying a new tool.

A classic ClickFix page has to invent a reason for the user to paste something. An InstallFix victim arrives expecting to run a command, so the attacker only has to swap it for a malicious one.

The second is searching for AI apps rather than going to them directly. Plenty of people reach the AI tools they use every day by typing the name into a search engine, and employees are adopting new AI apps faster than security teams can approve them. Both habits put the user on a search results page, which is exactly where ClickFix delivery happens.

InstallFix: Fake install pages that show the real command

Push first documented InstallFix in March 2026: cloned install pages for tools like Claude Code, Codex, and NotebookLM (which doesn't even have a desktop installer), promoted through search ads. The attacker copies the legitimate page and replaces the install command with one that delivers malware.

The latest cluster Push analyzed saw a Google search for "claude mac" return a sponsored result that displays bing.com as its domain. The ad passed the visitor through Bing's own click-tracking redirect to a compromised retail website, which forwarded them to a fake "Download Claude" page.

Two layers of cloaking, a server-side referrer check on the compromised site and a script on the fake page, send anyone who doesn't arrive through the ad to a benign page or a 404.

The lure itself is built to fool both a careful user and any control that reads the screen. The page displays Anthropic's genuine install command, but its copy button puts a different command on the clipboard.

That command first prints a legitimate claude.ai URL in the Terminal, then decodes a hidden URL and pipes the downloaded script straight into the shell without saving it to disk. A user who checks the page and then watches the Terminal sees Anthropic's domain both times.

Push has already seen the same trick on other lures, and because ClickFix toolkits copy each other's features quickly, it's spreading fast.

LLMshare: Lures hosted on the AI platforms themselves

LLMshare, a technique that Push reported in May 2026, abuses the sharing features of AI chatbots. Attackers create shared chats and Artifacts on ChatGPT and Claude that contain malicious install instructions or a link to a fake download page, then promote them through search ads. Because the lure is hosted on chatgpt.com or claude.ai, tools that rely on URL reputation checks have every reason to trust it.

The newest version uses custom GPTs, which turn the lure from a static page into a conversation.

A custom GPT is a configured version of ChatGPT that anyone with a paid account can build and share, and its creator writes hidden instructions that steer every reply. In the case Push analyzed, whatever the user typed, the GPT replied with a fake "Service Availability Notice" linking to a Google Sites page that served a Windows ClickFix payload.

It had more than 10,000 conversations when Push observed it.

A custom GPT is even more convincing than a shared chat because the user has to use it normally before the malicious link appears. Up to that point, the page behaves the way the user expected, and the fake outage notice reads like a routine service problem.

Why ClickFix is the weapon of choice in 2026

Microsoft's 2026 Digital Defense Report shows that ClickFix volume is still growing fast. ClickFix attacks grew roughly 23x between December 2025 and May 2026, and between February and early May alone, Microsoft Defender observed ClickFix-style attacker-supplied commands executed on more than 1.1 million unique devices.

In Microsoft's words, ClickFix is now "one of the most conversion-efficient initial access techniques," with 96.3% of ClickFix intrusions leading to malware. 

ClickFix breaks through typical detection controls because:

• Email security never sees a page the user reached through a search result.

• URL reputation and blocklists see bing.com, chatgpt.com, sites.google.com, or a legitimate website that has been compromised, and the main kits now use EtherHiding, storing their configuration in a smart contract on a public blockchain. There's no server to take down, and the operator can swap the payload URL on every compromised site with a single transaction.

Detections firing on compromised or legitimate sites often surprise new Push customers. Legitimate sites show up elsewhere in the chain too, as redirects, as hosting on services like Google Sites, and as we've shown, on AI platforms themselves.

Endpoint security is the last line of defense once the user pastes the command, and ClickFix is built to get through it. The user runs the command in a legitimate shell, so it doesn't match the process chains endpoint rules look for, and it runs in memory, leaving no file for a sandbox to detonate.

Push has also seen 84 command forms across more than 20 binaries, obfuscated to defeat string matching. And for BYOD devices, contractor machines, Macs, and developer workstations where EDR is often absent or tuned down, there's no protection at all.

These attacks are also hard to investigate after the fact, because many only fire under specific conditions. The ConsentFix campaign Push uncovered in December 2025, which was linked to the Russian state-affiliated group APT29, only served its lure to visitors who entered an email address on the attacker's target list.

Every compromised site in the campaign also shared an IP block list, so once a visitor had been served the lure, it never appeared for that IP address again on any of them. By the time an analyst checks a reported URL, the lure may have been rotated or taken down, or the page may simply load clean for anyone who didn't arrive the way the victim did.

Find out what's already reaching your users

You can see what attacks are reaching your own users with a free browser security assessment. It's a 30-day trial of the full Push platform, deployed through your MDM in under an hour.

At the end of the trial, you get a report covering the browser-based attacks detected, how employees are using AI tools and what they share with them, the accounts and browser extensions that leave you open to account takeover, and more.

In a recent trial at a financial services company with around 4,500 employees, Push detected and blocked 6 ClickFix attacks and 10 AiTM phishing attempts that the existing security stack had missed, intercepting them in the browser before the ClickFix payloads had a chance to reach the endpoint.

If you'd like to know more about Push and how we can help you stop browser-based attacks like ClickFix, AiTM phishing, and device code phishing, get visibility and control over the AI tools your workforce uses, and find the accounts at risk of takeover, book a demo.

Sponsored and written by Push Security.