ClickFix attacks infecting PCs and Macs are going viral
ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.
BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.
- Lorem Ipsum operation adopted ClickFix in late May 2026, eliminating code-signing requirements
- macOS ClickFix variants documented by Jamf can bypass Gatekeeper protections
- Netskope counted 5,400 sites beaconing to one ClickFix campaign's infrastructure
- Attackers abuse Google Sheets and blockchain smart contracts for command-and-control
- BlockBlock and uBlock can block ClickFix commands as soon as users paste them
- ATT&CK
- T1059 Command and Scripting InterpreterT1189 Drive-by CompromiseT1562.001 Impair Defenses: Disable or Modify Tools
- Products
- BlockBlockuBlock
- Threat actors
- Lorem IpsumSandworm
- Organizations
- BlueVoyantCisco TalosJamfNetskope
From the original article
2 min read at arstechnica.com
Simplicity—combined with the difficulty of getting stuff done—makes ClickFix ideal.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.