Cybercriminals are running ClickFix-style attacks at a volume the technique's researchers say they have not previously recorded — and fake AI-tool installers have become the most persuasive bait in the playbook, according to Push Security research covered by BleepingComputer on 16 October.
The warning matters because ClickFix is not an exploit chain. It is a persuasion chain — and that distinction is precisely why legacy controls struggle to stop it.
What ClickFix actually does
In a ClickFix attack, there is no vulnerable software to patch, no malicious attachment to sandbox and no macro to disable. The victim is walked through copying and running a command or script themselves — typically disguised as a fix for a supposed error, a verification step or a required installation step. The payload only executes because the user believes they are resolving a problem or installing a tool they wanted.
Push Security's research, as summarised by BleepingComputer, focuses on how the technique has scaled and how attackers have sharpened the lure around it. The company — which sells browser and identity security — characterises the trend as a record-setting volume of campaigns of this type. That scale claim is the vendor's own assessment rather than an independently corroborated count, and readers should treat it accordingly.
The fake-AI-installer lure chain
The most notable shift identified in the research is the pivot to generative-AI tooling as bait. Attackers are distributing fake installers, seeding malicious search results, and using trusted chatbot platforms to route victims toward the payload.
The lure works so well because of a demand gap. Employees across enterprises actively want access to AI assistants, and many are still navigating unclear approval processes for official rollout. A convincing replica of a wanted tool arrives pre-loaded with trust: the target is not merely willing to run an unknown binary, they are looking for one.
Malicious search listings extend the chain upstream, intercepting users at the moment of intent — when someone is actively hunting for a download link rather than passively receiving an email. Trusted chatbot surfaces add a further layer of apparent legitimacy.
Why legacy defences miss it
Because execution happens inside a legitimate session the user themselves initiated, the attack pattern sits awkwardly for tooling designed around malicious files and unauthorised processes. Email gateways flag attachments that never appear; endpoint products see a process the user chose to run; macro and attachment policies are irrelevant. The control gap is behavioural, not technical — which is why the practical defences are largely human and procedural.
What HK security teams should do
For security teams in Hong Kong reviewing their exposure, the research points toward a short, prioritised checklist:
- Treat "how do I get AI tools?" as a phishing-simulation theme. Staff asking this question are your highest-risk population for this lure. Build awareness content around fake installers and unsanctioned AI downloads specifically.
- Add clipboard-and-command guidance to baseline training. Any instruction asking a user to paste a command into a terminal, Run box or devtools console should be treated as hostile until verified through an internal channel.
- Route AI-tool requests through a named internal process. Reducing the demand gap removes most of the lure's power.
- Harden search and browser posture, including restrictions on unverified download sources and scrutiny of sponsored or unfamiliar results for popular tool names.
- Update detection logic to flag user-initiated command execution following a web download, rather than relying on file reputation alone.
As with any vendor-published research, Push Security's findings are best read as one informed view; independent corroboration of the record-scale claim has not been published.
Source: Push Security research, as reported by BleepingComputer.
網絡罪犯正以 ClickFix 手法發動攻擊，規模之大，研究人員稱前所未見——而假冒人工智能工具的安裝程式已成為此類攻擊手法中最具說服力的餌。以上為 Push Security 的研究結果，由 BleepingComputer 於 10 月 16 日報道。
此警告之所以重要，在於 ClickFix 並非漏洞利用鏈（exploit chain），而是說服鏈（persuasion chain）——正因為這一點區別，傳統防禦機制難以攔截。
ClickFix 的實際運作方式
在 ClickFix 攻擊中，沒有存有漏洞、需要修補的軟件，沒有需要沙盒隔離的惡意附件，也沒有需要停用的巨集。受害者被一步步引導，親自複製並執行指令或腳本——相關指示通常偽裝成修復錯誤、驗證步驟或必要安裝程序。惡意載荷之所以能夠執行，全因用戶相信自己正在解決問題或安裝心儀的工具。
Push Security 的研究經 BleepingComputer 總結，重點在於此手法如何擴大規模，以及攻擊者如何圍繞它打磨誘餌。這家銷售瀏覽器及身份保安方案的公司將此趨勢形容為同類攻擊活動錄得破紀錄的規模。該規模數據屬廠商自行評估，並非獨立核實的統計，讀者宜相應看待。
假冒人工智能安裝程式的誘餌鏈
研究中識別出最顯著的轉變，是攻擊者改以生成式人工智能工具作為餌。攻擊者散布假冒安裝程式、植入惡意搜尋結果，並利用受信任的聊天機械人平台將受害者引向惡意載荷。
此誘餌之所以奏效，在於存在需求落差。企業員工普遍渴望使用人工智能助理，許多人仍在摸索官方推廣的不明審批流程。一個逼真的心儀工具仿製版出現時，已內建信任基礎：目標不只是願意執行來路不明的二進位檔——他們本來就在尋找它。
惡意搜尋結果將誘餌鏈向上游延伸，在用戶產生意圖的瞬間攔截——當有人主動搜尋下載連結，而非被動接收電郵時。受信任的聊天機械人介面則增添多一層貌似正規的外觀。
傳統防禦為何失效
由於執行發生在用戶自己發起的合法會話之內，這種攻擊模式令針對惡意檔案及未授權進程而設計的工具難以應對。電郵閘道標記的附件根本不會出現；終端安全產品看到的是用戶自行選擇運行的進程；巨集及附件政策則完全無關。防禦缺口屬行為層面，而非技術層面——正因如此，實際防禦措施很大程度上依賴人為因素及流程規範。
香港保安團隊應採取的措施
針對檢視自身風險的香港保安團隊，研究建議以下簡短而有優先次序的清單：
- 將「如何取得人工智能工具？」列為釣魚演練主題。 提出此問題的員工，正是此類誘餌的最高風險群體。應圍繞假冒安裝程式及未經批准的人工智能下載，專門製作相關意識培訓內容。
- 在基礎培訓中加入剪貼簿及指令安全指引。 任何要求用戶在終端機、執行視窗或開發者工具控制台貼上指令的指示，在未經內部渠道核實前，一律應視為敵意行為。
- 將人工智能工具申請交由指定的內部流程處理。 縮減需求落差，即可消除誘餌的大部分威力。
- 強化搜尋及瀏覽器防護態勢，包括限制未經核實的下載來源，並審查熱門工具名稱下的贊助結果或陌生結果。
- 更新偵測邏輯，標記在網頁下載後由用戶自行發起的指令執行，而非僅依賴檔案信譽判斷。
如同任何廠商發布的研究，Push Security 的發現宜視為其中一個具參考價值的觀點；目前尚未有獨立核實有關破紀錄規模的說法。
來源：Push Security 研究，經 BleepingComputer 報道。