ClickFix campaign found across more than 5,400 compromised websites

Fresh telemetry from Netskope Threat Labs provides a measured view of the web infrastructure supporting ClickFix. In research published on 3 September, the company linked an ongoing campaign to malicious code on more than 5,400 compromised websites across more than 2,200 organisations.

Those figures do not represent infected computers or people who followed the malicious instructions. Netskope counted websites capable of exposing visitors to the campaign, with several hundred active on a typical day and weekday activity exceeding 300 sites. It did not publish infection success rates or a country-by-country breakdown.

This is the strongest fresh quantitative evidence in the reviewed material, but it measures compromised web infrastructure rather than successful infections. No authoritative global count exists for infected endpoints, confirmed data-theft victims, financial losses or service disruption across ClickFix campaigns.

Blockchain infrastructure broadens delivery

ClickFix is not a single software flaw. A malicious or compromised site imitates a CAPTCHA, security check or browser update, then persuades the visitor to copy or paste attacker-selected text into an operating-system shell. Executing that text starts a campaign-specific malware chain with the user’s own authority.

No CVE or universal affected-version range applies. Operators can combine the deception with compromised content management system assets, legitimate runtimes and trusted cloud or blockchain services, making delivery harder to identify and block. Netskope said the initial route used to compromise the affected websites remained unknown.

In the campaign disclosed on 3 September, Netskope found delivery instructions hosted through smart contracts on the BNB Smart Chain testnet. This allowed the blockchain to act as a dead-drop mechanism for campaign information while making that part of the infrastructure more resistant to conventional takedown efforts.

Netskope also identified a WebRTC-based variant that provided an alternative to the standard fake-CAPTCHA overlay. The change shows how delivery channels can be altered without abandoning the central deception: convincing a visitor to authorise activity in a native shell.

Together, these choices point to an adaptable delivery system built around a large pool of legitimate but compromised websites and external infrastructure that is difficult to disrupt. The measured scale belongs to this specific Netskope campaign and cannot be extrapolated to every ClickFix operation.

Separate campaigns span Windows and macOS

Primary research has documented ClickFix-style activity on Windows and macOS, but no reliable figures establish equal prevalence or support a direct comparison between the platforms. The findings come from separate campaigns and payloads.

On Windows, Microsoft’s TerminalFix research described an observed campaign that established persistence, performed environment reconnaissance, executed commands and created a reverse tunnel. That capability could turn an infected endpoint into a pivot for reaching other systems visible from its network position. The Hack Academy covered the TerminalFix campaign in detail on 9 September.

The macOS evidence comes from different research and campaigns. Jamf Threat Labs documented earlier MacSync Stealer variants that relied on ClickFix-style or drag-to-terminal execution. Mehmet Buğra Şahinoğlu separately described an EtherHiding campaign that used compromised legitimate websites against Mac users. No current macOS infection count matches Netskope’s website telemetry, and no macOS version has been established as completely unaffected.

The operators behind the Netskope campaign and Microsoft’s TerminalFix activity remain publicly unattributed in the reviewed material. Nothing in the research establishes that those campaigns share operators or infrastructure with the macOS activity.

Other actor assessments apply only to their respective operations. CERT-UA attributed a ClickFix campaign targeting Ukrainian organisations to Sandworm, also designated UAC-0002, and reported that at least one organisation experienced network compromise. Separately, BlueVoyant said it was tracking an active ClickFix campaign through compromised WordPress sites and assessed with high confidence that the Lorem Ipsum ecosystem was operationally linked to Rapid Brigantine, also tracked as Vanilla Tempest.

Those cases show the technique in financially motivated and state-linked activity, but they do not establish shared targeting, infrastructure or control. Consequences vary by payload: successful execution can lead to malware installation, persistence, reconnaissance, credential theft or remote command capability. In TerminalFix, the reverse-tunnel function also created potential for reaching systems beyond the initially infected endpoint.

Defences must address behaviour and websites

There is no universal ClickFix patch because the technique is not one product vulnerability. Operating-system, browser and endpoint-security updates remain important, but user-authorised shell activity may bypass controls focused narrowly on downloaded files. Platform updates should therefore be treated as one layer rather than a complete remedy.

Defenders should teach users that legitimate CAPTCHA, verification and browser-update pages should not require text to be pasted into Windows Run, PowerShell, Windows Terminal or macOS Terminal. Endpoint teams can monitor for unusual shell launches associated with browser activity, paste-and-execute behaviour and unexpected use of trusted signed binaries or runtimes.

Website operators also need to treat compromised web infrastructure as part of the attack surface. Recommended measures include integrity checks for CMS assets, investigation of unauthorised plugins, scripts and web shells, and removal of injected loaders. Netskope also advised organisations, where operationally appropriate, to evaluate blocking the implicated BNB Smart Chain testnet RPC infrastructure and monitor unexpected non-web WebRTC traffic.

For managed Macs, Objective-See independently documented XProtect-related terminal paste protection in macOS 26.4. Organisations can evaluate macOS 26.4 or later and validate the behaviour in their environments, but the control is a partial platform mitigation rather than a complete fix. No explicit Apple security advisory for the feature was identified in the reviewed research.

For Australian organisations, the relevance comes from the use of the affected operating systems and websites, plus Netskope’s description of a geographically diverse worldwide campaign. Direct Australian exposure to the Netskope, TerminalFix or macOS activity has not been established, and Netskope supplied no national breakdown. The clearest current measurement therefore remains more than 5,400 compromised websites, not a global total of infected endpoints, data-theft victims or losses.

Distinguishing a deceptive browser prompt from the shell activity it solicits helps explain why layered defences matter when no single software patch applies. Readers can investigate those layers through The Hack Academy’s online cybersecurity training programme, which offers self-paced learning and practical exercises alongside theory; its listed subjects include cybersecurity fundamentals, networking and internet vulnerabilities.