# ClickFix Social Engineering Clusters Target Windows and macOS Systems

> Insikt Group identifies five ClickFix clusters using obfuscated commands to exploit native system tools via fake browser error overlays on Windows and macOS.

- Published: 2026-03-25T12:25:41.000Z
- Severity: medium
- Category: Threat Intel
- Tags: ClickFix, Social Engineering, macOS Security, Powershell Obfuscation, Initial Access
- Author: Runtime Rebel Intel
- Primary source: https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos
- Canonical: https://runtimerebel.com/blog/clickfix-social-engineering-clusters-target-windows-and-macos-systems

## Key points

- Immediate impact: Attackers use deceptive browser overlays to trick users into running malicious commands, resulting in full system compromise.
- Affected systems: Windows and macOS devices are targeted via spoofed pages for services like QuickBooks, Booking.com, and Birdeye.
- Remediation: Organizations must restrict the execution of native system tools like PowerShell and Terminal for non-administrative users immediately.

## Overview of ClickFix Social Engineering Tactics

The threat landscape has seen a significant increase in the use of deceptive browser overlays, a technique frequently referred to as ClickFix. According to [Recorded Future](https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos), research by the Insikt Group has identified five distinct clusters of ClickFix activity targeting both Windows and macOS users. These campaigns rely on sophisticated [Phishing](/glossary#phishing) pages that mimic legitimate software errors to manipulate users into executing malicious code. This methodology bypasses traditional file-based detection by using the victim as the execution vector for native system commands.

The primary hook in these campaigns involves a simulated technical issue, such as a browser update failure or a document rendering error. When a user visits a compromised or spoofed site, a popup appears instructing them to 'fix' the issue by clicking a button. This button copies a malicious, obfuscated command to the user's clipboard and provides instructions on how to paste and execute it within a native system tool. Learning how to detect ClickFix social engineering is now a priority for [SOC](/glossary#soc) teams, as the attack bypasses many standard email gateway protections.

## Technical Analysis of Native Tool Exploitation

The ClickFix campaigns identified by Insikt Group target specific enterprise-related services, including QuickBooks, Booking.com, and Birdeye. By masquerading as these trusted platforms, threat actors increase the likelihood that a corporate user will follow the instructions to resolve a perceived technical hurdle. The attack chain is platform-aware, delivering different payloads based on the victim's operating system.

On Windows systems, the [TTP](/glossary#ttp) involves the execution of highly obfuscated PowerShell commands. These commands are often encoded in Base64 or hidden through complex string manipulation to evade [EDR](/glossary#edr) solutions that monitor for plain-text malicious strings. Once executed, the PowerShell script typically reaches out to a [C2](/glossary#c2) server to download secondary payloads, such as information stealers or [Ransomware](/glossary#ransomware) loaders. 

### Detecting ClickFix PowerShell Obfuscation in Enterprise Environments

For macOS users, the campaign pivots toward terminal-based exploitation. This demonstrates a broadening of the threat actor's scope, as ClickFix macOS malware delivery mechanisms are becoming more prevalent. The macOS variant typically instructs the user to open the Terminal and paste a command that looks like a system diagnostic utility but actually downloads and executes a Mach-O binary or a python-based backdoor. This cross-platform capability ensures that the threat actor can maintain [Initial Access] across diverse corporate environments.

Analysing the [MITRE ATT&CK](/glossary#mitre-att-ck) framework reveals that these clusters primarily leverage 'Command and Scripting Interpreter' (T1059) and 'User Execution' (T1204.002). Because the commands are executed within the context of a legitimate process (like powershell.exe or Terminal.app), they may not immediately trigger alerts that rely solely on file-on-disk signatures.

## Defensive Strategies and Remediation

Defending against ClickFix requires a multi-layered approach that combines technical controls with user awareness. Since the attack relies on user interaction, traditional perimeter defenses are often insufficient. Organizations should prioritise the following mitigations:

*   **Process Monitoring:** Configure [SIEM](/glossary#siem) and EDR tools to flag suspicious parent-child process relationships, specifically web browsers spawning command-line interfaces like PowerShell, CMD, or Terminal.
*   **Command-Line Logging:** Enable advanced logging (such as PowerShell Script Block Logging) to capture the full content of executed commands, which is essential for identifying obfuscated scripts after they have been de-obfuscated in memory.
*   **Restricting Native Tools:** Implement policies to restrict the execution of native system tools for standard users. If a user does not require PowerShell for their daily tasks, its execution should be blocked or heavily audited.
*   **User Training:** Educate employees on the specific mechanics of ClickFix attacks, emphasizing that legitimate software updates or error fixes will never require a user to manually copy and paste code into a terminal window.

By focusing on these structural defenses, organisations can significantly reduce the success rate of ClickFix campaigns and better protect their infrastructure from this evolving social engineering threat.

**Related:** [ClickFix Attack: Windows Terminal Used for Detection Evasion](/blog/clickfix-attack-windows-terminal-used-for-detection-evasion), [LeakNet Ransomware: ClickFix Exploitation and Deno Loader Analysis](/blog/leaknet-ransomware-clickfix-exploitation-and-deno-loader-analysis)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/clickfix-social-engineering-clusters-target-windows-and-macos-systems