ReliaQuest Reports ClickFix Dominates Malware Delivery, Expands to macOS
Summary
ReliaQuest says ClickFix dominated initial access and defense evasion in its March–May analysis, expanding to macOS and developer lures. The technique uses deceptive prompts to trick users into running malicious commands.
Key points
- ReliaQuest found ClickFix dominated initial-access and defense-evasion activity during its March 1–May 31 analysis.
- Fake CAPTCHAs, error messages and verification prompts persuade users to paste attacker-provided commands into system tools.
- ReliaQuest observed macOS campaigns delivering Atomic macOS Stealer (AMOS), including commands launched through Script Editor.
- A ClickFix loader delivering Deepload used heavy obfuscation; ReliaQuest said ClickFix accounted for nearly 28% of defense-evasion activity in the period.
- Developer-focused lures included malvertising for fake Claude Code and Homebrew installation guides; ReliaQuest reported finding exposed npm and Bitbucket tokens in process environment variables on compromised hosts.
- Some observed commands performed domain enumeration and established persistent access without dropping malware.
- ReliaQuest recommends training users, monitoring command execution and logging and alerting rather than blocking essential tools for developers.
Article Details
- Publisher
- Dark Reading
- Scope
- ClickFix activity involving initial access and defense evasion across Windows and macOS, including campaigns targeting developers.
- Key Statistics
- ClickFix drove nearly 28% of defense-evasion activity during the three-month period analyzed; the article does not specify the year.
- Recommendations
- Train users on Windows and macOS not to paste commands into Run, Terminal, or Script Editor, and simulate ClickFix lures.
- Consider restricting access to Run, Terminal, and Script Editor for average employees; for developers and technical staff, log and alert rather than block these workflow tools.
- Monitor for anomalous sequences such as base64 decoding, curl retrieval, and PowerShell or osascript execution.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationReliaQuest observed a ClickFix loader using heavy obfuscation, including thousands of variable assignments.T1059.001 · PowerShellThe article describes malicious command execution through PowerShell.T1059.002 · AppleScriptThe article describes commands run through Script Editor and monitoring for osascript execution.T1204.004 · Malicious Copy and PasteClickFix tricks users into copying and pasting attacker-provided commands.
People
Malware
Atomic macOS Stealer (AMOS)The technique has expanded to macOS, including campaigns delivering Atomic macOS Stealer.DeeploadThe tactic has evolved with variants like CrashFix, AMOS delivery on macOS, and loaders for Deepload, while attackers increasingly target developers through malvertising and emailed lures.
Products
Bitbucket#ClickFixGoogle AdsDevelopers are being targeted through malvertising and fake installation pages on Google Ads.macOSReliaQuest says ClickFix has rapidly become a leading malware delivery technique, driving both initial access and defense evasion by tricking users into pasting malicious commands into Windows and macOS tools.Microsoft WindowsReliaQuest says ClickFix has rapidly become a leading malware delivery technique, driving both initial access and defense evasion by tricking users into pasting malicious commands into Windows and macOS tools.npm#ClickFixScript Editor“This period, they switched to an applescript:// link that automatically opens Script Editor, a scripting app built into macOS, and runs the attacker’s commands there,” he wrote.