Skip to content
ClickFix Technique Surges with AI Lures in Cyber Attacks

ClickFix Technique Surges with AI Lures in Cyber Attacks

First seen 21 Oct 2026, 15:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 16:10 UTC
  • •ClickFix now constitutes over 52% of Push's monthly detections.
  • •AI-themed attacks are increasingly targeting users searching for AI tools.
  • •4 in 5 ClickFix pages intercepted in 2026 came from search engines.

ClickFix has emerged as a dominant cyber attack technique since 2024, now accounting for over 52% of Push's detections. This method has evolved to include sub-techniques like InstallFix and ConsentFix, with attackers increasingly using AI tools as bait. In Q2 2026, ClickFix detections reached 67%, surpassing other phishing methods. The latest trends show that 5% of attacks involve AI-themed InstallFix and LLMshare campaigns, primarily targeting users searching for AI tools. Push's data indicates that 4 in 5 ClickFix pages intercepted in 2026 originated from search engines, compromised sites, or malvertising. The rise in AI tool adoption has led to users frequently pasting commands from web pages, making them vulnerable to these attacks. Researchers have linked over 1,200 analyses to fake AI tool campaigns, with many impersonating popular tools like Claude and ChatGPT. The situation continues to evolve, posing significant challenges for security teams.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-01-01
ClickFix technique emerges
ClickFix is identified as a new cyber attack method gaining traction among criminals.
BleepingComputer
2026-03-01
InstallFix documented
Push first documented InstallFix, detailing cloned install pages for AI tools.
BleepingComputer
2026-10-21
ClickFix detections reach 67%
Push reports that ClickFix detections have surged to 67% of all browser-based attacks.
BleepingComputer

More articles in this cluster (3)

Following this threat?

Track APT29 and ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What is ClickFix?
ClickFix is a cyber attack technique that has rapidly gained popularity among criminals, particularly since 2024.
How are AI tools being exploited?
Attackers are using AI tools as bait in phishing campaigns, tricking users into pasting malicious commands.
What should organizations do to protect themselves?
Organizations should educate users about the risks of pasting commands from unverified sources and enhance detection capabilities for ClickFix-related attacks.