ClickFix Exploits Windows Run, macOS Terminal for Malware Delivery

Key Takeaways

• The ClickFix social engineering technique is rapidly spreading, tricking users into manually executing malicious commands on Windows and macOS systems.
• Attackers leverage fake verification screens (e.g., Cloudflare, Google reCAPTCHA) to deliver malware like NetSupport RAT, Odyssey Stealer, Lumma Stealer, and MacSync.
• The campaigns utilize “living-off-the-land” tactics, employing native system tools like Windows Run and macOS Terminal, making detection challenging for traditional browser-based defenses.
• Both cybercriminal groups and state-sponsored actors, including APT28 and PurpleBravo, have adopted ClickFix, targeting sectors such as accounting, travel, real estate, and legal services.
• Effective mitigation requires a combination of technical controls (disabling Windows Run, PowerShell constrained mode, MDM for macOS Terminal) and robust user awareness training.

ClickFix Campaigns Exploit Native OS Features for Malware Delivery on Windows and macOS

A sophisticated social engineering campaign, dubbed ClickFix, has resurfaced as a prevalent method for initial access, actively targeting users across both Windows and macOS operating systems. This technique manipulates individuals into willingly executing malicious commands, which subsequently install various malware strains on their devices without direct exploitation of software vulnerabilities.

First observed in late 2023, ClickFix has quickly evolved from a specialized tactic into a widely adopted strategy within the cybercriminal landscape, as detailed in a recent report. Its effectiveness stems from its deceptive simplicity, making it appear as a routine interaction to unsuspecting users. Instead of relying on complex exploits, the method presents victims with convincing fake verification screens, mimicking legitimate services such as Cloudflare CAPTCHA or Google reCAPTCHA.

The Deceptive Mechanism: From Clipboard to Command Line

The core of the ClickFix attack involves covertly placing a malicious command onto the user’s clipboard via background JavaScript. Victims are then prompted to paste this command into the Windows Run dialog box or the macOS Terminal. By doing so, users inadvertently grant attackers direct control over their systems, bypassing many conventional security measures. A comprehensive analysis of these campaigns is available in the <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/6c2f100e-0c89-4385-a4ac-f923bff1f4f6/New-ClickFix-Attack-Leverage-Windows-Run-Dialog-Box-and-macOS-Terminal-to-Deploy-Malware.pdf?AWSAccessKeyId=ASIA2F3EMEYEXKEKA2YU&Signature=KfWMUca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4Uca2NBXL4U

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.