ClickFix: 1.1 Million Devices Hit as Attackers Turn AI Tools Into Their Newest Lures

Social-engineering attacks that trick users into pasting malicious commands, known as ClickFix, have surged to become the most common threat Push Security detects, and the campaign family now increasingly impersonates AI tools including Claude, ChatGPT, Codex and NotebookLM, according to research published on October 21, 2026. Push Security's findings, carried by BleepingComputer, describe two named variants, InstallFix and LLMshare, that use cloned installer pages and malicious shared chats to reach people searching for AI software. The trend is independently supported by sandbox data from ANY.RUN and by Microsoft's 2026 Digital Defense Report, which recorded ClickFix-style commands executed on more than 1.1 million unique devices between February and early May 2026.

What was the specific vulnerability?

There is no single vulnerability: ClickFix is a family of social-engineering campaigns that abuse user trust and search-driven delivery rather than a flaw in any AI platform. According to Push Security, the AI-themed variants work in two ways. InstallFix uses cloned installation pages for Claude Code, Codex and NotebookLM, promoted through search ads. The page displays the genuine Anthropic install command, but the copy button places a malicious command on the clipboard. LLMshare distributes malicious shared chats and Artifacts on ChatGPT and Claude, along with malicious custom GPTs that answer every prompt with a fake "Service Availability Notice" linking to a ClickFix page on sites.google.com. Push observed one such custom GPT with more than 10,000 conversations.

The delivery chain documented by Push shows how deeply search is involved: a Google search for "claude mac" returned a sponsored result displaying bing.com as its domain, which passed through Bing's click-tracking redirect to a compromised retail website and then to a fake "Download Claude" page protected by two layers of cloaking, a server-side referrer check and a page script.

How was the incident detected?

The campaign family was detected and documented by Push Security through its browser-layer detection data, with InstallFix first documented in March 2026, LLMshare reported in May 2026 and the ConsentFix campaign uncovered in December 2025. ConsentFix, which Push linked to the Russian state-affiliated group APT29, only served lures to visitors on an attacker target list and used a shared IP block list so the lure never reappeared for a served IP. In a recent trial at a financial services company with roughly 4,500 employees, Push detected and blocked 6 ClickFix attacks and 10 AiTM phishing attempts that the company's existing security stack had missed. The broader trend is corroborated by BleepingComputer reporting that ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between April 15 and October 5, 2026, and by Microsoft's 2026 Digital Defense Report, which measured roughly 23-fold growth in ClickFix attacks between December 2025 and May 2026.

What is the current impact?

The impact is broad and ongoing: ClickFix averaged 52 percent of Push Security's detections through Q2 2026, overtaking AiTM and device code phishing for the first time, and reached 67 percent in August 2026. Four in five ClickFix pages Push intercepted in 2026 were reached from search engines, through compromised websites, malvertising or SEO poisoning. AI-themed InstallFix and LLMshare attacks made up about 5 percent of all attacks Push detected in its last quarterly snapshot. According to the ANY.RUN data cited in the report, 81 percent of the 1,258 fake AI tool campaigns impersonated Claude, ChatGPT or Codex, at least 45 percent told the victim to paste a command, and about a quarter started on a shared AI chat or artifact. Microsoft's 2026 Digital Defense Report describes ClickFix as "one of the most conversion-efficient initial access techniques," with 96.3 percent of ClickFix intrusions leading to malware. Employees searching for or installing AI tools are the primary targets, with BYOD devices, contractor machines, Macs and developer workstations where EDR is absent or tuned down especially exposed.

What are the next steps?

No patch applies, and mitigation rests on browser-layer detection and user awareness rather than platform fixes. Push's research points to two user habits that put people in the path of these attacks: installing tools from the terminal, since Claude Code ships as a one-line terminal install and users now routinely paste commands from web pages, and searching for AI applications rather than navigating to them directly. The kits themselves are hard to disrupt. Push has seen 84 obfuscated command forms across more than 20 binaries, payloads that run in memory in a legitimate shell and leave no file for sandboxes, and the use of EtherHiding, which stores configuration in a smart contract on a public blockchain so there is no server to take down and the payload URL can be swapped with one transaction. The report notes that Google, Anthropic and OpenAI have not been reported as having removed the abuse at scale.

By the numbers

Source snapshot