Cybersecurity
ClickFix campaigns now use AI tools
Push Security said ClickFix campaigns had spread into a wider family of variants and were increasingly using AI-themed lures, while its own telemetry, other researchers and Microsoft all reported sharp growth.
- Push Security said ClickFix averaged 52% of its detections through Q2 2026 and reached 67% in August.
- ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between 15 April and 5 October 2026.
- Microsoft's 2026 Digital Defense Report said ClickFix attacks grew about 23 times between December 2025 and May 2026, and Microsoft Defender saw attacker-supplied commands on more than 1.1 million unique devices.
- Push said a March 2026 InstallFix campaign used search ads, a fake Claude download page and a command that changed what was copied to the clipboard.
Push Security said ClickFix had become a common delivery method since about 2024 and had widened into several variants, including InstallFix, LLMshare and ConsentFix. It said recent lures had increasingly focused on people searching for and using AI tools.
The company said its detections showed ClickFix averaging 52% through Q2 2026, rising to 67% in August. It also said most intercepted ClickFix pages in 2026 were reached from search engines, while many browser-based attacks outside email came through other channels such as search and social media.
Push said it first documented InstallFix in March 2026 and saw a later campaign use a Google search for "claude mac" that led to a sponsored result showing bing.com. That path passed through Bing's click-tracking redirect, a compromised retail site and then a fake download page, where the visible command differed from the one copied to the clipboard.
Push said LLMshare used shared chats and Artifacts on ChatGPT and Claude, while a later version used custom GPTs that replied with a fake service notice linking to a Google Sites page. It said the GPT had more than 10,000 conversations when it was observed.
Microsoft's 2026 report said ClickFix attacks had grown sharply between December 2025 and May 2026, and that Microsoft Defender had seen attacker-supplied commands run on more than 1.1 million unique devices. The article also said Push had seen 84 command forms across more than 20 binaries and linked a separate ConsentFix campaign to APT29.
Named in this story
Companies
- Push Security
- its telemetry and examples underpinned the article
- Microsoft
- published the 2026 Digital Defense Report
- ANY.RUN
- sandbox provider that linked public analyses to fake AI campaigns
- Anthropic
- maker of Claude and Claude Code
- search engine that surfaced the sponsored result
Organisations
- APT29
- Russian state-affiliated group linked to the ConsentFix campaign
Products and systems
- ClickFix
- the browser-based technique the article tracked
- InstallFix
- a ClickFix variant that used fake install pages
- LLMshare
- a ClickFix variant that abused chatbot-sharing features
- ConsentFix
- a browser-native ClickFix variant linked to APT29
- Microsoft Defender
- the detection system cited in Microsoft's report
- Claude Code
- AI coding tool whose install command was copied
- Claude
- AI assistant impersonated in fake campaigns
- ChatGPT
- chatbot platform used for shared chats and custom GPTs
- Codex
- AI tool impersonated in fake install pages
- NotebookLM
- tool whose cloned install page Push documented
- Bing
- its redirect chain carried visitors on to the lure
- Google Sites
- hosting service used for the fake notice page
How the source tells it
The article used a promotional, vendor-led register that mixed threat emphasis with product marketing and repeated calls to act.
- threat inflation relies on large prevalence figures and failure scenarios to suggest a widespread, hard-to-stop problem
- urgency uses repeated speed and recency framing to imply the shift is happening now
- novelty presents AI tools and custom GPTs as the newest lure in the sequence
- vendor boosterism foregrounds Push Security's own telemetry and ends with product-led trial and demo prompts