ClickFix scam tricks Mac and Windows users into pasting malware

A scam called ClickFix is infecting Windows PCs and Macs by asking people to fix their own machines. A fake error message tells the victim their browser, video player, or document viewer hit a problem, then walks them through the fix: open a terminal or the Windows Run box, paste a command, hit enter. The command is the payload. There's no download prompt, no attachment, no exploit. The user runs the malware themselves, one paste at a time, per Ars Technica.

What makes it work is that it doesn't feel like an attack. It feels like troubleshooting. Anyone who's fixed a stuck npm install or a broken Homebrew tap by pasting a command from a forum post has already rehearsed this exact motion. Ars Technica reports the technique is now infecting Mac users at a scale similar to Windows, and that matters because a lot of security advice for regular users has assumed macOS is a smaller target.

The part that should bother developers specifically: this scam's cover story is a pattern we all ship on purpose. A one-line curl-pipe-to-bash install command is standard onboarding for half the tools I install. It's fast, it's one line, and it's also indistinguishable in spirit from what a ClickFix lure asks a victim to do. I'm not saying every install script is a threat. I'm saying we've spent years training users that pasting an unread command into a shell is a normal Tuesday, and this campaign is what happens when that training gets pointed at them by someone else.

A signed installer or a package manager entry doesn't stop a determined attacker from finding another vector. But it does mean your project isn't the thing that made "paste this to fix it" feel routine.