ClickFix may be the biggest security threat your family has never heard of

ClickFix is a relatively new technique that bypasses many endpoint protections and can affect both macOS and Windows, with researchers calling it a growing threat the public is largely unaware of. The attacks often begin with an email from a hotel with pending registrations, or via a WhatsApp message, or even a top-of-search results link, after which victims are asked to copy a text string into a terminal, triggering a hidden download and automatic installation of malware.

Once installed, the malware typically acts as a credential stealer, and campaigns have spread widely, aided by malvertising and a one-line installation command that can bypass Gatekeeper checks, according to CrowdStrike. In macOS campaigns, the primary payload is a credential-stealer tracked as Shamos, while Windows campaigns have included a malware family called PureRAT and other modules such as a botnet component and changes to macOS configuration.

Push Security and Microsoft have noted various payloads, including LOLbins that rely on living off the land, with many commands base-64 encoded inside browser sandboxes to evade detection. With awareness and caution about seemingly legitimate sites and prompts as the best defence, experts emphasise that family members should be informed about these tactics.