ClickFix Scams Trick Users Into Running Malicious Commands

Summary

ClickFix lures users with fake verification or tech-support prompts and tricks them into running commands themselves. Huntress says the technique accounted for over half of malware loader activity in its 2026 Cyber Threat Report.

Key points

ClickFix prompts may imitate human verification, technical support, or instructions to fix a browser problem.
Victims are directed to copy and run commands in PowerShell, a Windows Run window, or a terminal, including on Windows, Mac, and Linux.
The article says this approach can avoid suspicious downloads or unsolicited phishing links because users execute the commands themselves.
Huntress reports that ClickFix made up over 50% of malware loader activity, citing its 2026 Cyber Threat Report.
The article describes ClickFix infections leading to a LummaC2 infostealer compromise and another intrusion, but provides no detailed technical breakdown of those attack paths.
Huntress recommends security-awareness training and emphasizes rapid detection, response, and containment as part of resilience.