ClickFix Campaigns Expand, Using AI Tools as a Convincing Lure

Summary

Push and other researchers report growing ClickFix activity, including fake AI-tool installers and malicious chatbot content. Attackers use search ads, compromised sites, deceptive clipboard commands, and conditional delivery to evade defenses.

Key points

Push says ClickFix accounted for 52% of its detections on average through Q2 2026 and 67% in August; four in five ClickFix pages it intercepted in 2026 came from search engines.
Fake InstallFix pages imitate tools such as Claude Code and Codex, displaying a legitimate install command while copying a different, malicious command to the clipboard.
Push describes LLMshare lures hosted in shared AI chats and custom GPTs; one observed custom GPT directed users to a Windows ClickFix payload hosted on sites[.]google[.]com.
Microsoft reported that ClickFix attacks grew roughly 23-fold between December 2025 and May 2026, with Defender observing attacker-supplied commands executed on more than 1.1 million devices between February and early May.
The article says attackers use compromised sites, search ads, conditional cloaking, in-memory execution, and EtherHiding to complicate blocking and investigation.
Push links a ConsentFix campaign it uncovered in December 2025 to Russian state-affiliated group APT29; the lure was served only to visitors matching targeting conditions.

Article Details

Attack Vectors: Search ads and search-engine results lead users through redirects to compromised websites and fake AI-tool installation pages.
InstallFix pages display a legitimate install command but copy a different command that decodes a hidden URL and pipes a downloaded script into the shell.
LLMshare lures use shared AI chats, Artifacts, or custom GPTs to deliver malicious installation instructions or links to fake download pages.
ClickFix pages prompt users to paste attacker-supplied commands; reported variants run in memory and use obfuscation to evade string matching.
The reported ConsentFix campaign served its lure only to visitors whose email addresses were on a target list, and prevented repeat delivery to IP addresses that had already received it.
Defensive Notes: Do not rely solely on email security or URL reputation checks: many lures arrive through search engines, and some are hosted on legitimate services or compromised sites.
Treat commands copied from web pages as untrusted, even when the page displays a legitimate command or the terminal shows a legitimate vendor URL.
Endpoint defenses may have limited visibility when commands run in a legitimate shell, execute in memory, or are obfuscated; the article notes that some BYOD, contractor, Mac, and developer devices may lack or have reduced EDR coverage.
Investigations may not reproduce the lure because delivery can depend on referrer, visitor email, or IP address, and pages may be rotated or taken down.