- Push Security says ClickFix made up 52% of its detections through Q2 2026 and 67% in August, ahead of other browser-based attacks.
- AI-themed lures were around 5% of Push's detections; BleepingComputer argues AI habits make them convincing. Push says 4 in 5 ClickFix payloads came via search engines.
- Teams should test controls that act at the paste moment and set an approved route for finding and installing AI tools.
The attack asks your employee to do the work
The lesson of Push Security's new ClickFix data is simple. The attacker does not have to break into a machine. A worker only has to paste one line of text and press Enter.
BleepingComputer, which covered the report, argues that AI adoption has made this request look routine. Many AI tools install with one terminal command, it says. So people who never used a command line now paste one when trying new software. Push's data does not measure that habit. It measures what Push's tools detected.
Push is a browser security vendor, and the figures below come from its own detections. They describe what Push's tools intercepted. They are not a count of all attacks.
What Push's detections show
Push reports that ClickFix averaged 52% of its detections through the second quarter of 2026. This is the first time ClickFix has outweighed the other main browser attacks Push sees: attacker-in-the-middle phishing and device code phishing. In August the share reached 67%.
Push also notes that Microsoft reported ClickFix as its top initial access vector last year, at 47% of detections.
Delivery is the part email-focused budgets miss. Push says four in five of the ClickFix payloads it intercepted in 2026 began with a result on a search engine such as Google or Bing. The routes were compromised sites, malvertising and SEO poisoning. Push notes that these attacks bypass email-based controls entirely.
How the trick works
A ClickFix page shows a fake error, a fake CAPTCHA or a fake update. It quietly puts a command on the visitor's clipboard. It then tells the visitor to open the Windows Run box, a terminal or PowerShell and paste it. The user runs the code, so the page itself never has to deliver malware.
Push describes commands that fetch a script and run it in memory, so nothing is written to disk. Others hide the web address inside encoded text. Some break up words with extra characters so that automated scanners miss them. Push counted 84 distinct command forms, 34 of them seen only once. It also found that more than 20 different binaries appeared in the commands.
Three kits accounted for 73% of the ClickFix detections: ERRTRAFFIC, TURNTIP and NOCHAIN. ERRTRAFFIC alone was 34% in August. Push says it is sold as a service at $300 to $380 a month and has 11 or more confirmed criminal adopters. It mostly injects itself into compromised WordPress sites.
Where AI tools fit, and how large the effect is
Push says it first documented the install-page variant, called InstallFix, in March 2026. It saw cloned install pages for Claude Code, Codex and NotebookLM, which has no desktop installer. In one case, a search for "claude mac" returned a sponsored result showing bing.com as its domain. It led through a compromised retail site to a fake download page. The page showed the genuine install command, but its copy button put a different one on the clipboard.
The scale matters. BleepingComputer reports that in Push's latest quarterly snapshot, AI-themed install and shared-chat attacks were around 5% of everything Push detected. That is a small slice of a much larger ClickFix total.
BleepingComputer offers a reason the lure persuades. Older ClickFix pages need a cover story, such as a fake error, to justify why anyone should paste text. A fake AI install page needs none, because running a command is exactly what the visitor came to do. The attacker only changes what that command contains. That is the outlet's analysis, not a finding from Push's data.
BleepingComputer also points to work by the sandbox service ANY.RUN. It linked 1,258 public analyses to fake AI tool campaigns from mid-April to early October 2026. About 81% of them posed as Claude, ChatGPT or Codex. In at least 45% of the analyses, the bait was a fake install or download page that led victims to paste a command.
Why blocking attacker servers falls short
Many defences work by blocking attacker servers. Push says the main kits keep their configuration in a smart contract on a public blockchain, not on a web server. The method has a name: EtherHiding. There is no host to take down. The operator changes what every infected site serves with one transaction.
Netskope documented a campaign across 5,400 or more compromised sites that used a single contract. Push also cites 1,509 WordPress sites feeding ClickFix chains in July 2026. Another 700 or more Ghost CMS sites were compromised through CVE-2026-26980 in May 2026.
The standard advice to disable the Run box has a gap too. Push says Windows has no built-in policy to disable the Win+X menu. Even with both shortcuts closed, a shell can be reached from Start search, File Explorer or Task Manager.
What to ask your team
Treat the paste as the control point. That control can come from any browser, endpoint or policy tool, not only Push's product. Ask your security lead four questions.
First, can we detect or block a command pasted from a web page, whatever tool it calls? Second, do contractor, personal and Mac devices have the same protection as managed laptops? Third, what is the approved way for staff to find and install AI tools, so nobody searches for one and follows a sponsored result? Fourth, have staff been told that no real install or CAPTCHA step asks them to paste a command into a terminal?
Training should stress that a verification step does not need a Run box. Push's data shows that most ClickFix payloads it intercepted came from search results, where email controls do not apply.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Push Security.
