↓ Skip to main content
karmine’s notes
  1. Tags/

Infostealer

ClickFix — Copy/Paste Social Engineering: Threat Brief and Fleet Detection Pack

·3567 words·17 mins
Security-Ops Fleet Osquery Windows Macos Social-Engineering Infostealer Threat-Intel Detection-Engineering Clickfix Netsupport-Rat
ClickFix is the most active cross-platform initial-access technique of 2026 — fake CAPTCHAs and support prompts that silently copy a malicious command to the clipboard, instruct the user to paste it into the Windows Run dialog or macOS Terminal, and deliver infostealers (Lumma, AMOS), remote-access tools (NetSupport RAT), and AppleScript keychain stealers. No code-execution vulnerability is exploited — the victim is the delivery mechanism. This brief walks the five-stage attack flow, lists atomic indicators, and ships a Fleet/osquery detection pack with every query validated against the current Fleet table schema.