ClickFix Social Engineering Is Now the Leading Malware Delivery Method
KnowBe4, Tuesday, July 14th, 2026
ReliaQuest research finds ClickFix has become the top malware delivery technique and has expanded to macOS.
Citing ReliaQuest research, KnowBe4 reports that ClickFix has overtaken other techniques to become the leading malware delivery method.
The attack manipulates users into copying attacker-supplied commands and running them in a terminal, sidestepping many file-based controls.
ClickFix has reached macOS for the first time, delivering infostealers to a platform that historically receives lighter monitoring.
Researchers note threat actors are using AI tools to scale these lures with minimal effort, and that delivery has shifted from compromised websites toward emailed links.
KnowBe4 recommends training employees never to paste commands into terminals and simulating ClickFix-style lures such as fake CAPTCHA and verification screens on both Windows and macOS.