ClickFix: The High-ROI “Living-off-the-Land” Trap Sweeping Windows and macOS

This report details ClickFix, a high-ROI social-engineering technique that prompts users to manually run malicious commands (via Windows Run or macOS Terminal) to execute malware in-memory and evade typical browser and endpoint controls; it outlines five sector-targeted clusters (e.g., QuickBooks, faux reCAPTCHA, macOS storage cleaning), notes use by access brokers and APT actors like BlueDelta, and recommends behavioral hardening measures including disabling Run, PowerShell CLM, macOS MDM controls, and focused user training.