GoKawiilClickFix phishing technique surges, now disguised as AI tool installs
Push Security reports that ClickFix, a phishing technique that tricks users into running malicious commands, accounted for an average 52% of its detections through Q2 2026, rising to 67% in August. Newer variants impersonate AI tools like Claude and ChatGPT, with ANY.RUN linking over 1,200 sandbox analyses to fake AI campaigns between April and October 2026, 81% of which impersonated Claude or ChatGPT/Codex.
GoKawiil's interpretation of the reporting above, not reported fact.
The technique's growth suggests attackers are exploiting workforce habits around installing and trusting AI tools, which could make these lures harder to distinguish from legitimate software adoption. Because most ClickFix pages are reached via search engines rather than email, traditional email security filters may be less effective at catching this threat, according to Push's data.
- ClickFix detections rose from 52% to 67% of Push's intercepted attacks between Q2 and August 2026
- 4 in 5 ClickFix pages were reached via search engines rather than email, per Push Security
- ANY.RUN found 81% of fake AI tool campaigns impersonated Claude or ChatGPT/Codex
YubiKey 5C NFC Security Key — With ClickFix and AI-themed phishing lures tricking users into running malicious commands, hardware-based authentication is one of the few defenses that doesn't rely on spotting a scam in time. A YubiKey adds phishing-resistant multi-factor authentication to your accounts, so even if credentials are stolen via a fake AI tool page, attackers can't log in without the physical key.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-21
Published there as: “ClickFix has never been bigger, and AI tools are its most convincing lure yet”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.