ClickFix Attacks Target AI Users Through Search Results, Fake Installers and ChatGPT

ClickFix emerged around 2024 and has quickly become a go-to technique for cybercriminals. Its growing family of subtechniques includes FileFix, InstallFix, TerminalFix and the browser-native ConsentFix.

These attacks are becoming more targeted. Recent campaigns increasingly focus on people searching for and using artificial intelligence tools, allowing malicious pages to blend into legitimate traffic for approved generative AI services.

Push detection data shows how widespread ClickFix has become. By Q2 2026, ClickFix accounted for an average of 52% of Push detections. It surpassed AiTM and device-code phishing for the first time and reached 67% in August.

Across browser-based attacks, one in two victims arrived through channels other than email, including search engines and social media. The remainder came through email but were not stopped by email gateways.

ClickFix goes a step further: four out of five ClickFix pages intercepted in 2026 came from search engines, driven by website compromises, malvertising and SEO poisoning.

AI tools are the latest ClickFix lure

The latest ClickFix campaigns use AI tools as decoys. In Push’s most recent quarterly snapshot, AI-themed InstallFix and LLMshare attacks represented approximately 5% of all attacks detected by Push, making them a growing part of the ClickFix family.

Other researchers have observed the same trend. According to ANY.RUN, researchers linked 1,258 public sandbox analyses to a fake AI tool campaign between April 15 and October 5, 2026. About 81% impersonated Claude, ChatGPT or Codex. At least 45% came from campaigns that instructed victims to paste commands through fake CLI installation or download pages using ClickFix. Another quarter began with shared AI chats or artifacts.

These lures exploit two habits that AI adoption is spreading across the workforce.

First, more people are installing AI tools from the terminal. Tools such as Claude Code use one-line terminal installation commands, encouraging people who previously did not use a command line to paste instructions from web pages.

Traditional ClickFix pages require victims to believe they have a reason to paste a command. InstallFix attacks remove that obstacle: victims arrive expecting to execute an installation command, so attackers can replace the legitimate command with a malicious one.

Second, users often search for AI applications instead of navigating directly to official websites. Employees are adopting new AI services faster than security teams can approve them, sending users to search results where malicious ads and compromised pages can deliver ClickFix lures.

InstallFix uses fake AI installation pages

Fake installation pages display legitimate commands but copy malware

Push documented its first InstallFix campaign in March 2026. Clone installation pages for tools including Claude Code, Codex and NotebookLM were promoted through search ads. The attackers copied legitimate pages but replaced the installation commands with commands that delivered malware.

In a modern campaign analyzed by Push, a Google search for “claude mac” returned sponsored results that displayed bing.com as the domain. The advertisement sent visitors through a compromised retail website and Bing’s click-tracking redirect before directing them to a fake “Download Claude” page.

Two layers of cloaking helped conceal the campaign. A server-side referrer check on the compromised website and a script on the fake page sent visitors who did not arrive through the advertisement to a benign page or a 404 error.

The fake installation page was designed to fool both attentive users and security controls. It displayed Anthropic’s official installation command, but clicking the copy button placed a different command on the clipboard.

The malicious command first prints the canonical claude.ai URL in the terminal. It then decodes a hidden URL and pipes the downloaded script directly to the shell without saving it to disk. Users reviewing the page and monitoring the terminal therefore see Anthropic’s domain in both cases.

Push has observed the same technique in other lures, while ClickFix toolkits continue to spread as attackers copy one another’s functionality.

LLMshare hosts ClickFix lures on AI platforms

LLMshare is a technique that Push reported in May 2026. It abuses the sharing features of AI chatbots. Attackers create shared chats and artifacts on ChatGPT and Claude containing malicious installation instructions and links to fake download pages, then promote them through search advertisements.

Because these lures are hosted on chatgpt.com or claude.ai, URL reputation systems have good reason to trust them.

The latest version uses custom GPTs to turn static invitations into conversations. A custom GPT is a configured version of ChatGPT that anyone with a paid account can build and share. Its creator can add hidden instructions that control the GPT’s replies.

In cases analyzed by Push, the custom GPT returned a fake “service availability notification” regardless of what the user entered. The notification linked to a Google Sites page that served a Windows ClickFix payload.

When Push observed the campaign, more than 10,000 conversations were taking place.

Custom GPT lures can be more persuasive than shared chats because users must interact with them normally before the malicious link appears. Until that point, the page behaves as expected, making the fake outage notification appear to be a routine service issue.

Why ClickFix is becoming a preferred attack technique in 2026

Microsoft’s 2026 Digital Defense Report shows that ClickFix activity is growing rapidly. ClickFix attacks increased approximately 23-fold between December 2025 and May 2026. Between February and early May, Microsoft Defender observed ClickFix-style attacker-supplied commands being executed on more than 1.1 million unique devices.

Microsoft describes ClickFix as “one of the most conversion-efficient early access technologies,” with 96.3% of ClickFix intrusions resulting in malware.

ClickFix can bypass common security controls for several reasons:

• Email security: Pages that users reach through search results are not inspected by email gateways.
• URL reputation and blocklists: Victims may browse to legitimate domains such as bing.com, chatgpt.com or sites.google.com, or to compromised websites. Leading kits also use EtherHiding to store configurations in smart contracts on public blockchains. Because there are no traditional servers to take down, operators can exchange payload URLs for compromised sites in a single transaction.

New Push customers are often surprised when detections begin on compromised or legitimate websites. Legitimate domains can appear throughout the attack chain as redirectors or hosting services such as Google Sites. As Push has shown, malicious content can also appear on the AI platform itself.

Endpoint security is the last line of defense after a user pastes a command, but ClickFix is designed to evade it. Because the user executes the command in a regular shell, it may not match the process chain expected by endpoint rules. The command can also run in memory without leaving files for a sandbox to launch.

Push has observed 84 command forms across more than 20 binaries, with obfuscation used to defeat string matching. In addition, bring-your-own-device systems, contractor machines, Macs and developer workstations may lack endpoint detection and response protection or may not be configured for it.

Many ClickFix attacks only activate under specific conditions, making them difficult to investigate after the fact. The ConsentFix campaign discovered by Push in December 2025 and associated with the Russian state-affiliated group APT29, for example, only lured visitors whose email addresses appeared on the attackers’ target list.

All websites compromised in that campaign also shared an IP blocklist. After a visitor was targeted, their IP address could not trigger the lure on that website again. By the time an analyst investigates a reported URL, the lure may have been rotated or removed, or the page may load normally for anyone who did not arrive through the same path as the victim.

Find out what browser-based attacks are reaching your users

To see which attacks are reaching your users, request a free browser security assessment. The assessment includes a 30-day trial of the complete Push platform, which can be deployed in under an hour through MDM.

At the end of the trial, organizations receive a report covering detected browser-based attacks, employee use and sharing of AI tools, accounts and browser extensions at risk of takeover, and more.

During a recent trial at a financial services company with approximately 4,500 employees, Push detected and blocked six ClickFix attacks and 10 AiTM phishing attempts that were missed by the existing security stack. The platform intercepted the ClickFix payloads in the browser before they reached the endpoint.

Want to learn more about stopping browser-based attacks such as ClickFix, AiTM phishing and device-code phishing? Book a demo to learn how Push can help organizations gain visibility and control over the AI tools employees use and identify accounts at risk of takeover.

Sponsored and written by Push Security.