As reported by BleepingComputer, Push Security's latest detection data reveals that ClickFix has overtaken adversary-in-the-middle and device code phishing as the dominant browser-based attack vector of 2026 — reaching 67% of detections by August. This is not a fringe technique anymore. It is the primary pathway adversaries use to reach your users.

Threat Alert: As reported by BleepingComputer, Push Security's latest detection data reveals that ClickFix has overtaken adversary-in-the-middle and device code phishing as the dominant browser-based attack vector of 2026 — reaching 67% of detections by August.

Why AI Tools Changed the Threat Surface

The critical insight here is not that ClickFix is new — it emerged in 2024 — but that AI tool adoption has fundamentally altered user behavior in ways that make ClickFix trivially effective. Two specific behavioral shifts matter:
  • Terminal normalization: Claude Code, OpenAI's tooling, and similar products ship as one-line terminal installs. Employees who would never have opened a command prompt two years ago now routinely paste commands from web pages. Adversaries no longer need to invent a pretext for command execution — the user arrives expecting to do it.
  • Search-mediated discovery: Workers increasingly find AI tools through search engines rather than direct navigation. This creates a sprawling attack surface where SEO poisoning, malvertising, and compromised sites can intercept users before they ever reach a legitimate vendor domain.

The result: 4 in 5 ClickFix pages intercepted in 2026 were reached from search engines. Email security — the industry's most mature defensive layer — is largely irrelevant to this traffic. Your gateway can be perfect and still miss these attacks entirely.

The attacks succeed because they exploit trust in a workflow, not trust in a sender. The user trusts the act of searching, clicking a result, and pasting an install command — because that is exactly what their legitimate AI tools require them to do.

Who Is Most Exposed

Organizations with rapid, decentralized AI adoption are the primary targets. If your employees are trying new AI tools faster than your security team can evaluate and approve them — which describes most enterprises today — you are exposed. Development teams are particularly at risk given the heavy use of CLI-based AI coding tools. ANY.RUN's data showing 81% of fake AI campaigns impersonating Claude, ChatGPT, or Codex confirms that adversaries are specifically targeting the tools technical staff use daily.

What the Original Reporting Misses

Push Security's data is compelling, but several defensive dimensions deserve deeper attention:

Who Is Most Exposed
ConsentFix is the silent escalation: The browser-native ConsentFix variant doesn't require the user to paste anything — it abuses OAuth consent flows. This bypasses endpoint detection entirely since no executable runs. Identity-layer monitoring is the only reliable control.
Shadow AI amplifies risk: The same behaviors that make ClickFix effective also make shadow AI adoption harder to detect. An employee pasting a malicious install command looks identical to one installing a legitimate tool your team hasn't approved yet.
Supply chain crossover: Compromised legitimate websites serving ClickFix payloads via SEO poisoning means your web-facing infrastructure can become an unwitting distribution channel for attacks against your own customers.

Shield53 Recommendations

Immediate Actions

  • Deploy browser-layer security controls. Email gateway detection alone cannot address attacks that arrive through search and social. A browser security platform or secure web gateway with real-time URL analysis is now essential, not optional.
  • Inventory and approve AI tools formally. Publish an internal directory of sanctioned AI tools with direct links. Reduce the habit of search-based discovery that creates interception opportunities.
  • Restrict terminal execution paths. Implement application allowlisting on developer endpoints. Legitimate AI CLI tools should be installed through managed package managers, not arbitrary pasted commands.
  • Monitor OAuth consent grants. ConsentFix bypasses traditional endpoint controls. Alert on any new OAuth grant to unverified applications, especially those requested outside normal onboarding windows.

Strategic Actions

  • Build AI-specific phishing simulations. Traditional phishing training covers credential harvesting. You need scenarios that test whether users will paste a command from a fake AI installer page.
  • Partner with marketing on SEO defense. If your organization runs ads or manages organic search presence, ensure your domains and campaigns can't be spoofed or outranked by malicious actors targeting your employees.
  • Track ClickFix IOCs and infrastructure. ERRTRAFFIC and similar kits generate detectable patterns. Feed known infrastructure into your block lists and threat intelligence platform.

The takeaway is straightforward: the security industry optimized for email-based threats over two decades. ClickFix bypasses that investment entirely by moving the attack to the browser and the terminal. Defenders need to follow the users, not the legacy controls.