The ClickFix attack vector, which gained momentum in late May 2026, exploits user fatigue by mimicking legitimate CAPTCHA prompts. Attackers compromise established websites to display fake verification boxes that instruct users to copy and paste malicious commands into the Windows Run, PowerShell, or macOS terminal.
According to security firm BlueVoyant, this method removes the need for attackers to maintain complex infrastructure, such as SEO-manipulated portals or trusted signing certificates. Instead, the attack relies on the user voluntarily executing commands, which significantly broadens the potential victim pool beyond specific software searches.
The threat affects both Windows and macOS users. Researchers from Jamf have documented variations that bypass macOS Gatekeeper protections. Furthermore, Cisco Talos reports that attackers are utilizing public services like Google Sheets to host malicious infrastructure, while others, including the Sandworm group, employ blockchain-based smart contracts.
The scale of these campaigns is substantial. Security firm Netskope identified a single campaign involving 5 400 compromised websites. While tools like BlockBlock and Ublock updates can help mitigate these threats by monitoring or blocking suspicious terminal activity, the attack method remains highly effective and continues to evolve.
