ClickFix Now Cybercriminals' Favorite Malware Delivery Technique

ReliaQuest analysis found that the ClickFix social-engineering technique became the dominant malware delivery method between March and May 2026 by tricking users into pasting attacker-supplied commands into Run/Terminal/Script Editor; this bypasses many defenses and has been used to deliver Windows and macOS malware (including Deepload and AMOS infostealer) to steal credentials, cookies, and crypto wallets. The report urges user training (do not paste commands), simulated exercises, and administrative controls (restrict run dialog/clipboard, block malicious sites, restrict execution) to mitigate the threat.