ClickFix attacks infecting PCs and Macs are going viral
ars ·
ClickFix attacks, once considered exotic, have gone mainstream and are now widely used to infect both Windows PCs and Macs. The technique requires only a compromised website, a fake CAPTCHA overlay, and a terminal command that visitors are tricked into copying and pasting into Windows Run, PowerShell, or the macOS terminal. Attackers exploit user fatigue bred by unclosable interstitials, endless CAPTCHA image puzzles, and constantly changing interfaces, which desensitizes people to seemingly burdensome instructions. According to security firm BlueVoyant, the shift to ClickFix in late May 2026 eliminated the need for code-signing and costly infrastructure like SEO-manipulated download portals and rotated domains, while broadening the victim pool. Mac users are not spared: security firm Jamf and a researcher have documented macOS variants that bypass Gatekeeper. Attackers continue to innovate, hosting command infrastructure in publicly published Google Sheets documents and blockchain-based smart contracts, a tactic used by Russia's state-sponsored Sandworm, with Netskope counting 5,400 sites beaconing to one such campaign. Defenses such as BlockBlock for Macs and an updated uBlock can block ClickFix when a user pastes a command, and the article argues that victim-blaming only worsens the problem while urging more security-savvy users to educate family, friends, and neighbors. The mass adoption of ClickFix demonstrates its effectiveness, and it is not going away soon.
ars