/
← Voltar ao feed
high financial services technology

ClickFix surges to 52% of Push detections, with fake AI tool lures (InstallFix, LLMshare) delivering malware via search ads

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 11:00 · coletado há 2 dias

ClickFix and its variants (FileFix, InstallFix, TerminalFix, ConsentFix) are now the most common browser-based attack technique seen by Push Security. They averaged 52% of Push detections through Q2 2026 and reached 67% in August, overtaking AiTM and device code phishing. The newest lures impersonate AI tools: ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between 15 April and 5 October 2026, and 81% of them impersonated Claude, ChatGPT or Codex. Delivery relies mostly on search engines (4 in 5 ClickFix pages), through compromised sites, malvertising and SEO poisoning. This is a vendor-sponsored article, so the figures reflect Push's own telemetry and should be read as such.

Detalhes técnicos

  • InstallFix: cloned install pages for Claude Code, Codex and NotebookLM, promoted through search ads. In the latest cluster, a Google search for "claude mac" returned a sponsored result showing bing.com as its domain. It passed through Bing's click-tracking redirect to a compromised retail site, then to a fake "Download Claude" page.
  • Cloaking: a server-side referrer check and an on-page script send visitors who did not arrive via the ad to a benign page or a 404.
  • The page shows Anthropic's genuine install command, but the copy button places a different command on the clipboard. That command prints a legitimate claude.ai URL, decodes a hidden URL and pipes the downloaded script straight into the shell without writing it to disk.
  • LLMshare (reported May 2026): shared chats and Artifacts on ChatGPT and Claude carry malicious install instructions or links, promoted through search ads. The newest version uses custom GPTs. One example replied with a fake "Service Availability Notice" linking to a Google Sites page that served a Windows ClickFix payload, and had more than 10,000 conversations.
  • Microsoft's 2026 Digital Defense Report: ClickFix grew roughly 23x between December 2025 and May 2026, and 96.3% of ClickFix intrusions led to malware. Between February and early May, Defender observed ClickFix-style commands executed on more than 1.1 million unique devices.
  • Evasion: the main kits use EtherHiding (configuration stored in a smart contract on a public blockchain), so there is no server to take down. Commands run in memory from a legitimate shell, and Push saw 84 command forms across more than 20 binaries, obfuscated to defeat string matching.
  • The ConsentFix campaign uncovered in December 2025 was linked to APT29. It served its lure only to visitors who entered an email address on the attacker's target list, and compromised sites shared an IP block list.

Remediação

  • The article's recommendation is browser-level detection and visibility, since email security, URL reputation and some endpoint controls miss these chains. It also recommends visibility into AI tool usage and shadow IT. This is promoted through Push's free 30-day assessment.
  • Treat BYOD devices, contractor machines, Macs and developer workstations as higher risk, since EDR is often absent or tuned down there.
  • Train users not to paste commands from web pages or search ads, even for install commands that look legitimate.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 12:00 primeiro registro

    ClickFix surges to 52% of Push detections, with fake AI tool lures (InstallFix, LLMshare) delivering malware via search ads

    ler a análise desta fonte

    ClickFix and its variants (FileFix, InstallFix, TerminalFix, ConsentFix) are now the most common browser-based attack technique seen by Push Security. They averaged 52% of Push detections through Q2 2026 and reached 67% in August, overtaking AiTM and device code phishing. The newest lures impersonate AI tools: ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between 15 April and 5 October 2026, and 81% of them impersonated Claude, ChatGPT or Codex. Delivery relies mostly on search engines (4 in 5 ClickFix pages), through compromised sites, malvertising and SEO poisoning. This is a vendor-sponsored article, so the figures reflect Push's own telemetry and should be read as such.

    Technical Details

    • InstallFix: cloned install pages for Claude Code, Codex and NotebookLM, promoted through search ads. In the latest cluster, a Google search for "claude mac" returned a sponsored result showing bing.com as its domain. It passed through Bing's click-tracking redirect to a compromised retail site, then to a fake "Download Claude" page.
    • Cloaking: a server-side referrer check and an on-page script send visitors who did not arrive via the ad to a benign page or a 404.
    • The page shows Anthropic's genuine install command, but the copy button places a different command on the clipboard. That command prints a legitimate claude.ai URL, decodes a hidden URL and pipes the downloaded script straight into the shell without writing it to disk.
    • LLMshare (reported May 2026): shared chats and Artifacts on ChatGPT and Claude carry malicious install instructions or links, promoted through search ads. The newest version uses custom GPTs. One example replied with a fake "Service Availability Notice" linking to a Google Sites page that served a Windows ClickFix payload, and had more than 10,000 conversations.
    • Microsoft's 2026 Digital Defense Report: ClickFix grew roughly 23x between December 2025 and May 2026, and 96.3% of ClickFix intrusions led to malware. Between February and early May, Defender observed ClickFix-style commands executed on more than 1.1 million unique devices.
    • Evasion: the main kits use EtherHiding (configuration stored in a smart contract on a public blockchain), so there is no server to take down. Commands run in memory from a legitimate shell, and Push saw 84 command forms across more than 20 binaries, obfuscated to defeat string matching.
    • The ConsentFix campaign uncovered in December 2025 was linked to APT29. It served its lure only to visitors who entered an email address on the attacker's target list, and compromised sites shared an IP block list.

    Remediation

    • The article's recommendation is browser-level detection and visibility, since email security, URL reputation and some endpoint controls miss these chains. It also recommends visibility into AI tool usage and shadow IT. This is promoted through Push's free 30-day assessment.
    • Treat BYOD devices, contractor machines, Macs and developer workstations as higher risk, since EDR is often absent or tuned down there.
    • Train users not to paste commands from web pages or search ads, even for install commands that look legitimate.