ClickFix grows 23x as AI tools become its most convincing lure

ClickFix, a technique that tricks users into pasting commands into a terminal, has become the leading malware delivery method, with Microsoft reporting roughly 23x growth between December 2025 and May 2026. New InstallFix and LLMshare variants impersonate Claude Code, Codex and ChatGPT installs, and 81% of 1,258 ANY.RUN campaigns analyzed mimicked Claude, ChatGPT or Codex.

• ClickFix made up 52% of Push detections in Q2 2026, rising to 67% in August
• 4 in 5 ClickFix pages intercepted in 2026 were reached from search engines
• 81% of 1,258 ANY.RUN campaigns impersonated Claude, ChatGPT or Codex
• Microsoft: ClickFix attacks grew roughly 23x from December 2025 to May 2026