huntress.comarticleThat “Friendly” Prompt is ClickFix
Huntress overview of ClickFix, a social-engineering technique that tricks users into pasting and executing attacker-supplied commands into PowerShell, Run dialogs, or terminals (via fake CAPTCHA/human-verification or tech-support lures) rather than delivering malware through links or attachments. The post cites Huntress 2026 Cyber Threat Report data showing ClickFix accounts for over 50% of malware loader activity and walks through variant types and a real intrusion chain leading to LummaC2 infostealer compromise.
TL;DR Huntress breaks down ClickFix — the paste-and-run social-engineering technique now driving over half of observed malware loader activity, illustrated with a LummaC2 infostealer compromise chain.
Organisations named here
- ClickFix
Technologies named here
- Windows
- PowerShell
- Mac
- Run window
- Terminal
- Linux
- Huntress
- macOS
Techniques named here
- ClickFix social engineering
- Human verification lure
- Fake tech support / browser crash fix lure
Threat actors named here
- ClickFix
- LummaC2
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup