ClickFix-family attacks exploit a consistent psychological pattern: present the victim with a fabricated problem (a broken CAPTCHA, a crashed browser, a failed installer, an inaccessible file) and a deceptively simple 'fix' that requires the victim to paste and run attacker-controlled code themselves, sidestepping browser download protections, mark-of-the-web warnings, and email attachment scanning because the user — not the attacker — executes the payload.

The original ClickFix lure presents a fake 'I'm not a robot' verification page whose 'Fix' button copies a PowerShell or Run-dialog command to the clipboard and instructs the victim to press Win+R and paste it. Huntress reported a 631% increase in ClickFix-related incidents over a six-month period (Aug 2024-Aug 2025), and ClickFix fueled 53% of all malware loader activity observed by Huntress in 2025.

CrashFix (documented by Microsoft, Feb 2026) escalates the lure: a malicious browser extension masquerading as 'uBlock Origin Lite' (distributed via malvertising redirecting to a spoofed Chrome Web Store) deliberately triggers an infinite-loop denial-of-service against the victim's own browser after a delay, then a fake 'CrashFix' repair pop-up pressures the user into pasting a recovery command. The command copies finger.exe to %TEMP% renamed as ct.exe (SHA-256 beb0229043741a7c7bfbb4f39d00f583e37ea378d11ed3302d0a2bc30f267006) to abuse the little-monitored Windows finger utility (TCP/79) as a covert retrieval/beaconing channel, then downloads an obfuscated script.ps1 (SHA-256 c76c0146407069fd4c271d6e1e03448c481f0970ddbe7042b31f552e37b55817) that fingerprints the host for analysis tooling (Wireshark, Process Hacker, WinDbg) and domain-join status before exfiltrating recon data via POST. Domain-joined targets receive a portable WinPython distribution (WPy64-31401) bundling a Python RAT payload (modes.py), identified as ModeloRAT, executed covertly via pythonw.exe. ModeloRAT beacons over HTTP to {C2_IP}:80/beacon/{client_id} and performs domain/network reconnaissance with nltest, whoami, and net use. Persistence is established via an HKCU Run key and a scheduled task named 'SoftwareProtection' that re-executes a Python payload (udp.pyw) every 5 minutes to blend with legitimate Windows Update Medic / software-protection services.

InstallFix and TerminalFix present the copy-paste lure inside a fake failed-installer screen or a macOS/Linux Terminal 'verification' prompt respectively — functionally identical social-engineering wrappers around the same clipboard-hijack mechanic, now cross-platform. Microsoft's parallel Feb-May 2026 reporting ('Infostealers without borders', 'ClickFix campaign uses fake macOS utilities lures') documents ClickFix-style DMG installer and Terminal-paste lures delivering macOS-native and Python-based infostealers — DigitStealer, MacSync, and Atomic macOS Stealer (AMOS) — often bundled together in the same campaign infrastructure, hosted on legitimate platforms (Cloudflare Pages, Squarespace, Tencent EdgeOne) and advertised via malicious search-engine ads impersonating developer tools such as Anthropic's Claude Code. MacSync supports dynamic AppleScript payloads and in-memory execution to evade static/behavioral detection; DigitStealer performs locale/country checks and exits on certain configurations, consistent with organized-crime operational discipline.

FileFix (researcher mr.d0x, disclosed 2025, actively tested in the wild per Check Point) is the most significant structural variant: instead of the Win+R Run dialog, the lure triggers a browser file-upload dialog (which opens Windows File Explorer) and instructs the victim to paste a 'file path' into the Explorer address bar via Ctrl+L. JavaScript on the page silently places a PowerShell command on the clipboard, concatenated after a comment token with a fake, benign-looking file path so the visible pasted text looks legitimate while the full clipboard content executes as a command when the Explorer address bar interprets it. Because the technique lives in File Explorer rather than the Run dialog or a terminal, it evades a large share of user security-awareness training built specifically around 'never paste into Run/PowerShell.' Check Point observed a known ClickFix threat actor (previously targeting cryptocurrency-platform users) testing FileFix with benign payloads within two weeks of public disclosure, signaling operational adoption ahead of live malware delivery.

GhostClaw (JFrog Security Research, discovered/disclosed March 2026) is a supply-chain pivot of the same family into the npm ecosystem: a malicious package, @openclaw-ai/openclawai (versions 1.5.14/1.5.15), impersonated the legitimate 'OpenClaw' AI-agent CLI installer. Uploaded to npm on 2026-03-03 by user 'openclaw-ai', downloaded 178 times before removal around 2026-03-10. A postinstall hook silently re-installs the package globally to place an 'openclaw' binary on PATH. The first-stage dropper, scripts/setup.js, is obfuscated via string-table shuffling, RC4 decoding, and control-flow flattening; it fetches an ~11,700-line second-stage JavaScript bundle (internally named GhostLoader, publicly tracked as GhostClaw) from C2 domain trackpipe[.]dev, decrypted with AES-256-GCM (16-byte IV/16-byte auth tag). The C2 domain and paths are hidden as XOR-encoded integer arrays in source; the bootstrap endpoint is /t/bootstrap?t=<GUID> tagged with campaign ID 'complexarchaeologist1', and the malware performs IP geolocation via ipinfo.io/json. GhostClaw social-engineers the victim's own OS account password (fake Keychain prompt on macOS, PowerShell auth prompt on Windows, su on Linux) to decrypt browser-stored credentials across Chrome, Brave, Edge, Vivaldi, Opera, Yandex, and Comet (via CDP and SQLite extraction), plus Firefox via NSS/PKCS12. On macOS with Full Disk Access it harvests the Keychain databases (login.keychain-db and iCloud Keychain, including -wal/-shm journals), Apple Notes (NoteStore.sqlite), iMessage history (chat.db, with real-time monitoring), Safari history, Mail account configs, and Apple Account data. It targets SSH keys, AWS/Azure/GCP/Kubernetes/Docker credentials, npm/Git/GitHub CLI configs, and a broad set of desktop and browser-extension crypto wallets (Exodus, Electrum, Atomic, Bitcoin Core, Ledger Live, Sparrow, Wasabi, Trezor Suite, MetaMask, Phantom, Solflare), including BIP-39 seed-phrase scanning via wordlist ratio matching, and even scrapes credentials/state for other AI-agent CLIs (ZeroClaw, PicoClaw, OpenClaw). Persistence: on macOS/Linux, monitor.js is dropped to ~/.cache/.npm_telemetry/ and hooked into ~/.zshrc, ~/.bashrc, ~/.bash_profile disguised as '# NPM Telemetry Integration Service' with a PID-based watchdog; Linux adds an @reboot cron entry disguised as '# Node.js Telemetry Collection'; Windows installs to %APPDATA%/.npm_telemetry/monitor.js. Stolen data is archived as tar.gz and exfiltrated primarily to trackpipe.dev, with a Telegram Bot API fallback (<49MB) or GoFile.io with a password-locked, bearer-token-authenticated fallback for larger archives. The RAT component beacons every ~25s (30% jitter) and supports EXEC (shell command, 85s timeout), OPEN (URL), UPDATE (AES-256-GCM-encrypted remote payload), GRAB (file exfil), RECOLLECT (re-run collection), PROXY_START/STOP/STATUS (SOCKS5 proxy), CLONE_START/STOP/STATUS (headless browser cloning via CDP relay), and NUKE (self-destruct); it also monitors the clipboard every 3 seconds for private-key and crypto-address patterns (BTC/ETH, hex/WIF/Solana), AWS keys, and OpenAI/Stripe API keys. Anti-forensics measures include detached child processes (stdio ignored), 60-second temp-payload deletion, PID-lock single-instance enforcement, loot-directory cleanup post-exfiltration, and debug-log exfiltration to Telegram before exit.

Collectively this threat family represents a single evolving tradecraft lineage — 'make the victim run the payload themselves' — expanding across lure surface (CAPTCHA → browser crash → installer → file dialog → terminal), operating system (Windows → macOS → Linux), and distribution channel (malvertising → search ads → npm supply chain), with rising real-world incident volume and confirmed live weaponization of the newest (FileFix, GhostClaw) variants.