New ClickFix Attack Exploits Windows Run Dialog and macOS Terminal to Deploy Malware

Insikt Group describes the ClickFix campaign, a social‑engineering technique that coerces victims into executing obfuscated commands in Windows Run/PowerShell and macOS Terminal to fetch and run in‑memory malware (examples include NetSupport RAT and MacSync stealer). Analysts tracked five clusters since May 2024 using DOM hashing and content pivots to map malicious infrastructure; the report warns ClickFix is a resilient, widely adopted initial‑access method expected to persist through 2026 and recommends hardening native shells, applying execution controls, and user training.