ProBackend
Vulnerabilities & Exploits
1 hour ago7 min read

AI cybersecurity threats: How ClickFix turns AI tool searches into malware routes

ClickFix attackers exploit fake AI installers, poisoned search results and trusted chatbot experiences. Learn how the campaigns work and how to reduce risk.

AI cybersecurity threats: why ClickFix is finding new victims

ClickFix has grown from fake error prompts into a family of lures that includes FileFix, InstallFix, TerminalFix and browser-native ConsentFix. The common thread is simple: instead of relying only on an attachment, attackers persuade someone to take an action that launches the attack. In 2026, AI software has given them a timely pretext to get people to copy commands, visit unfamiliar pages or trust an online assistant.

Push Security’s figures, reported by BleepingComputer, show what the company saw in its own detections: ClickFix averaged 52% of Push detections through Q2 2026 and reached 67% in August. Push also said four in five ClickFix pages it intercepted in 2026 were reached from search engines, including through compromised sites, malvertising and SEO poisoning. These figures describe one security provider’s intercepted activity; they do not establish the same proportions across all organizations or attacks.

How people find software matters. Employees may search for a new AI tool instead of going directly to its official website. A convincing imitation can appear through a search ad or on a compromised page. And as terminal-based installation becomes more familiar, a command prompt may seem like an ordinary part of setup. Attackers take advantage of both habits.

What is AI in cybersecurity—and how is AI used in cybersecurity?

AI can help security teams analyze activity, spot suspicious patterns and investigate incidents. But the campaigns in this article are about a different risk: attackers using the popularity of AI tools and the ways people find them to make familiar social-engineering tricks more convincing. The reports cited here do not show that generative AI autonomously created or carried out these attacks.

In these cases, the threat is not that an AI tool is inherently unsafe. It is that a fake installer can substitute a harmful command for a safe-looking one, a shared chat can direct someone to a malicious page, or a custom chatbot can deliver a fabricated service notice. Security teams should account for how employees discover and use AI tools, while recognizing the familiar ingredients at work: impersonation, misleading instructions and malicious code.

InstallFix: cloned AI installers and clipboard substitution

InstallFix targets people who expect to install software. Push Security first documented it in March 2026, describing cloned pages for tools including Claude Code, Codex and NotebookLM. The last example is notable in Push’s report because NotebookLM did not have a desktop installer; the false premise itself can be part of the deception. Attackers promoted these pages through search advertisements and replaced legitimate installation instructions with commands that deliver malware.

A campaign described in the BleepingComputer report shows why a quick visual check may not be enough. A Google search for “claude mac” returned a sponsored result that displayed bing.com as its domain. The visitor was redirected through Bing click tracking to a compromised retail site and then to a fake “Download Claude” page. Cloaking checks could show a benign page or an error to visitors who did not arrive through the expected advertising path, making investigation more difficult.

The page displayed Anthropic’s genuine installation command, but its copy button put a different command on the clipboard. The malicious command printed a legitimate claude.ai address in Terminal, then decoded a hidden URL and piped a downloaded script directly into the shell without saving it to disk. That sequence is designed to undermine two checks: trusting the page’s appearance and glancing at the terminal output. What a page displays is not necessarily what its button copies.

A command that downloads and immediately executes a remote script gives the remote source substantial control over what runs. Don’t paste commands just because a page looks polished, a domain seems familiar or the terminal echoes a trusted brand. Get installation instructions by navigating independently to the vendor’s official website or verified documentation, and inspect commands before running them.

LLMshare: when chatbot trust becomes part of the lure

LLMshare uses the sharing features of AI chat products. According to Push, attackers created shared chats or artifacts on services such as ChatGPT and Claude containing installation instructions or links to fake download pages, then promoted them through search ads. A link hosted on a recognizable AI platform may look trustworthy to users and URL-based controls, but user-generated content on a legitimate service can still be malicious.

Push reported that the technique evolved to include custom GPTs: configured ChatGPT experiences whose creators can steer their responses. In one case analyzed by Push, a custom GPT replied to user prompts with a fake “Service Availability Notice” and linked to a Google Sites page serving a Windows ClickFix payload. Push observed more than 10,000 conversations with the GPT. That figure reflects engagement with this particular lure as observed by the researcher; it is not a count of confirmed infections.

The conversational format can lend the lure credibility. Someone may interact normally before a bogus service notice appears, and the message may resemble a routine outage announcement. But a link or instruction inside a familiar chatbot is not automatically an official vendor notice. Check service alerts through the provider’s status page, accessed independently, and treat unexpected download or command instructions with suspicion.

Why these campaigns can work

ClickFix puts the emphasis on influencing a person rather than simply breaking through a technical control. Search results reach people when they are looking for an installer; cloned branding can lower suspicion; and terminal commands can look like routine setup steps. A chatbot may provide a familiar interface before sending someone to attacker-controlled content. Cloaking and multi-hop redirects can make the path harder to inspect.

Technical defenses still matter, but they are not enough on their own. A browser may load a legitimate hosting platform that contains harmful user-generated content, or a security tool may see the address of a trusted service instead of the final destination. Pair endpoint protections with browser safeguards, controls on software acquisition and clear guidance for users. Push’s telemetry and other researchers’ reports offer evidence about observed campaigns, not a complete count of global activity.

Practical defenses for individuals and organizations

  • Go directly to the software maker’s official domain or documentation instead of selecting sponsored installer results. Check the domain carefully, especially when a search result shows an unexpected or redirecting address.
  • Don’t assume a command is safe because it appears on a legitimate-looking page. Inspect the clipboard before running anything, and compare the command with instructions obtained independently from the vendor.
  • Be especially cautious with commands that decode hidden content, fetch a script from an unfamiliar address or pipe a download straight into a shell. If you can’t explain what a command does, don’t execute it; ask your IT or security team.
  • Treat shared chats, custom GPTs, artifacts and chatbot-generated “service notices” as content that can be manipulated. Verify notices through official status channels and avoid unexpected download links.
  • Organizations should offer an approved way to find and install AI tools, and make it easy for employees to check whether a product or command is legitimate. Browser and endpoint controls can help detect malicious destinations and script execution; monitoring search-ad and shadow-IT exposure can reveal risky paths.
  • Train employees on the specific behavior ClickFix depends on: persuading someone to paste or run something. Show them how to check for clipboard substitutions and verify installation sources, rather than simply telling them to “be careful.”

The takeaway for 2026

These campaigns use familiar social engineering in the context of AI tools people want to try. InstallFix takes advantage of the expectation that a new tool may need a terminal command; LLMshare borrows credibility from shared chatbot experiences. A search result or an instruction inside a recognizable AI service is no guarantee of authenticity. Go to the vendor directly, inspect commands before running them and use browser and endpoint protections together. Those steps can stop a misleading page from becoming code execution.

Sources

ai cybersecurity threats