New ClickFix Attack Leverage Windows Run Dialog Box and macOS Terminal to Deploy Malware

Recorded Future researchers describe the resurgence and rapid expansion of the ClickFix social-engineering technique, where users are lured into pasting hidden commands into Windows Run or macOS Terminal to execute in-memory malware (NetSupport RAT, various stealers, MacSync). The report covers five distinct clusters that impersonate trusted services, use living-off-the-land techniques and native shells to avoid detection, lists example infrastructure and themes, and provides mitigation guidance including disabling the Run dialog, applying PowerShell/AppLocker controls, restricting terminal access, and user training.