# ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering Attacks

> A rapidly diversifying family of copy-and-paste social engineering techniques (ClickFix, CrashFix, InstallFix, FileFix, TerminalFix) tricks users into pasting attacker-supplied commands into PowerShell, Run dialogs, macOS Terminal, or the Windows File Explorer address bar via fake CAPTCHA checks, browser-crash prompts, or installer failures — leading to RAT deployment, credential/session theft, and persistence. A related npm supply-chain variant, GhostClaw, impersonated the OpenClaw AI-agent CLI to distribute a cross-platform infostealer/RAT via a malicious dependency.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1551
- **ID:** TL-2026-1551
- **Severity:** HIGH
- **Category:** SOCIAL_ENGINEERING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickFix-family attacks exploit a consistent psychological pattern: present the victim with a fabricated problem (a broken CAPTCHA, a crashed browser, a failed installer, an inaccessible file) and a deceptively simple 'fix' that requires the victim to paste and run attacker-controlled code themselves, sidestepping browser download protections, mark-of-the-web warnings, and email attachment scanning because the user — not the attacker — executes the payload.

The original ClickFix lure presents a fake 'I'm not a robot' verification page whose 'Fix' button copies a PowerShell or Run-dialog command to the clipboard and instructs the victim to press Win+R and paste it. Huntress reported a 631% increase in ClickFix-related incidents over a six-month period (Aug 2024-Aug 2025), and ClickFix fueled 53% of all malware loader activity observed by Huntress in 2025.

CrashFix (documented by Microsoft, Feb 2026) escalates the lure: a malicious browser extension masquerading as 'uBlock Origin Lite' (distributed via malvertising redirecting to a spoofed Chrome Web Store) deliberately triggers an infinite-loop denial-of-service against the victim's own browser after a delay, then a fake 'CrashFix' repair pop-up pressures the user into pasting a recovery command. The command copies finger.exe to %TEMP% renamed as ct.exe (SHA-256 beb0229043741a7c7bfbb4f39d00f583e37ea378d11ed3302d0a2bc30f267006) to abuse the little-monitored Windows finger utility (TCP/79) as a covert retrieval/beaconing channel, then downloads an obfuscated script.ps1 (SHA-256 c76c0146407069fd4c271d6e1e03448c481f0970ddbe7042b31f552e37b55817) that fingerprints the host for analysis tooling (Wireshark, Process Hacker, WinDbg) and domain-join status before exfiltrating recon data via POST. Domain-joined targets receive a portable WinPython distribution (WPy64-31401) bundling a Python RAT payload (modes.py), identified as ModeloRAT, executed covertly via pythonw.exe. ModeloRAT beacons over HTTP to {C2_IP}:80/beacon/{client_id} and performs domain/network reconnaissance with nltest, whoami, and net use. Persistence is established via an HKCU Run key and a scheduled task named 'SoftwareProtection' that re-executes a Python payload (udp.pyw) every 5 minutes to blend with legitimate Windows Update Medic / software-protection services.

InstallFix and TerminalFix present the copy-paste lure inside a fake failed-installer screen or a macOS/Linux Terminal 'verification' prompt respectively — functionally identical social-engineering wrappers around the same clipboard-hijack mechanic, now cross-platform. Microsoft's parallel Feb-May 2026 reporting ('Infostealers without borders', 'ClickFix campaign uses fake macOS utilities lures') documents ClickFix-style DMG installer and Terminal-paste lures delivering macOS-native and Python-based infostealers — DigitStealer, MacSync, and Atomic macOS Stealer (AMOS) — often bundled together in the same campaign infrastructure, hosted on legitimate platforms (Cloudflare Pages, Squarespace, Tencent EdgeOne) and advertised via malicious search-engine ads impersonating developer tools such as Anthropic's Claude Code. MacSync supports dynamic AppleScript payloads and in-memory execution to evade static/behavioral detection; DigitStealer performs locale/country checks and exits on certain configurations, consistent with organized-crime operational discipline.

FileFix (researcher mr.d0x, disclosed 2025, actively tested in the wild per Check Point) is the most significant structural variant: instead of the Win+R Run dialog, the lure triggers a browser file-upload dialog (which opens Windows File Explorer) and instructs the victim to paste a 'file path' into the Explorer address bar via Ctrl+L. JavaScript on the page silently places a PowerShell command on the clipboard, concatenated after a comment token with a fake, benign-looking file path so the visible pasted text looks legitimate while the full clipboard content executes as a command when the Explorer address bar interprets it. Because the technique lives in File Explorer rather than the Run dialog or a terminal, it evades a large share of user security-awareness training built specifically around 'never paste into Run/PowerShell.' Check Point observed a known ClickFix threat actor (previously targeting cryptocurrency-platform users) testing FileFix with benign payloads within two weeks of public disclosure, signaling operational adoption ahead of live malware delivery.

GhostClaw (JFrog Security Research, discovered/disclosed March 2026) is a supply-chain pivot of the same family into the npm ecosystem: a malicious package, @openclaw-ai/openclawai (versions 1.5.14/1.5.15), impersonated the legitimate 'OpenClaw' AI-agent CLI installer. Uploaded to npm on 2026-03-03 by user 'openclaw-ai', downloaded 178 times before removal around 2026-03-10. A postinstall hook silently re-installs the package globally to place an 'openclaw' binary on PATH. The first-stage dropper, scripts/setup.js, is obfuscated via string-table shuffling, RC4 decoding, and control-flow flattening; it fetches an ~11,700-line second-stage JavaScript bundle (internally named GhostLoader, publicly tracked as GhostClaw) from C2 domain trackpipe[.]dev, decrypted with AES-256-GCM (16-byte IV/16-byte auth tag). The C2 domain and paths are hidden as XOR-encoded integer arrays in source; the bootstrap endpoint is /t/bootstrap?t=<GUID> tagged with campaign ID 'complexarchaeologist1', and the malware performs IP geolocation via ipinfo.io/json. GhostClaw social-engineers the victim's own OS account password (fake Keychain prompt on macOS, PowerShell auth prompt on Windows, su on Linux) to decrypt browser-stored credentials across Chrome, Brave, Edge, Vivaldi, Opera, Yandex, and Comet (via CDP and SQLite extraction), plus Firefox via NSS/PKCS12. On macOS with Full Disk Access it harvests the Keychain databases (login.keychain-db and iCloud Keychain, including -wal/-shm journals), Apple Notes (NoteStore.sqlite), iMessage history (chat.db, with real-time monitoring), Safari history, Mail account configs, and Apple Account data. It targets SSH keys, AWS/Azure/GCP/Kubernetes/Docker credentials, npm/Git/GitHub CLI configs, and a broad set of desktop and browser-extension crypto wallets (Exodus, Electrum, Atomic, Bitcoin Core, Ledger Live, Sparrow, Wasabi, Trezor Suite, MetaMask, Phantom, Solflare), including BIP-39 seed-phrase scanning via wordlist ratio matching, and even scrapes credentials/state for other AI-agent CLIs (ZeroClaw, PicoClaw, OpenClaw). Persistence: on macOS/Linux, monitor.js is dropped to ~/.cache/.npm_telemetry/ and hooked into ~/.zshrc, ~/.bashrc, ~/.bash_profile disguised as '# NPM Telemetry Integration Service' with a PID-based watchdog; Linux adds an @reboot cron entry disguised as '# Node.js Telemetry Collection'; Windows installs to %APPDATA%/.npm_telemetry/monitor.js. Stolen data is archived as tar.gz and exfiltrated primarily to trackpipe.dev, with a Telegram Bot API fallback (<49MB) or GoFile.io with a password-locked, bearer-token-authenticated fallback for larger archives. The RAT component beacons every ~25s (30% jitter) and supports EXEC (shell command, 85s timeout), OPEN (URL), UPDATE (AES-256-GCM-encrypted remote payload), GRAB (file exfil), RECOLLECT (re-run collection), PROXY_START/STOP/STATUS (SOCKS5 proxy), CLONE_START/STOP/STATUS (headless browser cloning via CDP relay), and NUKE (self-destruct); it also monitors the clipboard every 3 seconds for private-key and crypto-address patterns (BTC/ETH, hex/WIF/Solana), AWS keys, and OpenAI/Stripe API keys. Anti-forensics measures include detached child processes (stdio ignored), 60-second temp-payload deletion, PID-lock single-instance enforcement, loot-directory cleanup post-exfiltration, and debug-log exfiltration to Telegram before exit.

Collectively this threat family represents a single evolving tradecraft lineage — 'make the victim run the payload themselves' — expanding across lure surface (CAPTCHA → browser crash → installer → file dialog → terminal), operating system (Windows → macOS → Linux), and distribution channel (malvertising → search ads → npm supply chain), with rising real-world incident volume and confirmed live weaponization of the newest (FileFix, GhostClaw) variants.

## MITRE ATT&CK

- T1583.001 Domains
- T1195.001 Compromise Software Dependencies and Development Tools
- T1585 Establish Accounts
- T1189 Drive-by Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1059.006 Python
- T1059.004 Unix Shell
- T1053.003 Cron
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1546.004 Unix Shell Configuration Modification
- T1505 Server Software Component
- T1053.005 Scheduled Task
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1036.003 Rename Legitimate Utilities
- T1070.004 File Deletion
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1555.001 Keychain
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1056.003 Web Portal Capture
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1482 Domain Trust Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer

## Sources

- [ClickFix, CrashFix and the Growing Family of Copy and Paste Attacks](https://www.pentestpartners.com/security-blog/clickfix-crashfix-and-the-growing-family-of-copy-and-paste-attacks/)
- [New Clickfix variant 'CrashFix' deploying Python Remote Access Trojan](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/)
- [Infostealers without borders: macOS, Python stealers, and platform abuse](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [GhostClaw Unmasked: A Malicious npm Package Impersonating OpenClaw to Steal Everything](https://research.jfrog.com/post/ghostclaw-unmasked/)
- [Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials](https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html)
- [ClickFix Attack: Variants, Detection & How It Works](https://www.huntress.com/blog/dont-sweat-clickfix-techniques)
- [FileFix - A ClickFix Alternative](https://mrd0x.com/filefix-clickfix-alternative/)
- [FileFix: The New Social Engineering Attack Building on ClickFix Tested in the Wild](https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging](https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html)
- [New FileFix Attack Weaponizes Windows File Explorer for Stealthy Commands](https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1551