ClickFix attacks have taken a sharp turn. What started as a relatively niche social engineering technique has evolved into a polished, paid advertising operation — and small and medium businesses are squarely in the crosshairs. Hackers are now buying Google Ads placements and exploiting Bing redirect behaviour to serve convincing fake pages for AI tools like Claude, tricking employees into running malicious commands that hand over credentials and system access. If your team uses AI tools — and most do — this threat is worth understanding before it lands in your inbox.
What Is a ClickFix Attack and Why Is It So Effective
ClickFix is a social engineering technique where attackers present a fake error message or verification prompt on a spoofed website, then instruct the visitor to paste a command into their Windows Run dialog or terminal to "fix" the problem. That command silently installs malware in the background. There is no suspicious attachment to open, no obvious phishing email to spot. The victim follows what looks like a standard troubleshooting step, and the damage is done.
This approach is effective precisely because it bypasses the security training most employees have received. People know not to click attachments from strangers. Far fewer people know to be suspicious of typing a command into their own computer at a website's request. Attackers are exploiting that gap deliberately, and the results speak for themselves. Security researchers have tracked a significant rise in ClickFix campaigns throughout 2025 and 2026.
How Hackers Are Using Google Ads and Bing to Scale These Attacks
What makes the current Claude-themed campaign especially dangerous is the delivery mechanism. Rather than relying on phishing emails, which spam filters increasingly catch, attackers are purchasing legitimate Google Ads slots and exploiting open redirect flaws in Bing URLs to push their fake Claude pages to the top of search results. To the average employee searching for a Claude download or login page, the result looks identical to a genuine advertisement from Anthropic.
The fake pages are professionally designed. They mimic the real Claude interface closely enough that even cautious users are unlikely to notice the difference. Once on the page, visitors are presented with a fabricated error — something about a browser configuration issue or a missing component — and guided through the ClickFix prompt. Within minutes, infostealer malware can be running silently on the machine, harvesting saved passwords, session cookies, and anything stored in the browser.
What Ends Up on the Dark Web After an Infection
This is where the long-term risk sits. Infostealer malware does not just steal what is on the screen. It systematically pulls credentials from every browser profile on the device, saved passwords, authentication tokens, VPN credentials, and sometimes SSH keys or API tokens stored in local files. That data is then packaged and sold on dark web markets, often within hours of the infection.
For a small business, one infected laptop can expose customer login portals, accounting software credentials, cloud storage access, and internal admin accounts. The employee who ran that command may never realise anything happened. The business may not find out until a breach notification arrives months later, or until an attacker has already been inside the network long enough to cause serious damage. This is exactly the kind of exposure Breachrr is built to catch — by continuously monitoring infostealer dumps, dark web markets, and credential databases for signs that your company's data has surfaced where it should not be.
How to Reduce Your Exposure to ClickFix Attacks Right Now
The most immediate step is awareness. Make sure your team knows that legitimate software companies never ask users to paste commands into Windows Run or a terminal as part of a login or setup process. That instruction, wherever it appears, is a red flag. Train people to close the tab and report it rather than follow through.
Beyond training, verify that your browser environments are locked down. Managed browsers with strict extension policies and DNS filtering can block many of the domains these campaigns rely on. Where possible, use a password manager rather than browser-saved passwords, since infostealer malware specifically targets browser credential stores.
Finally, assume that despite your best efforts, something may get through. Early detection is what limits damage. If stolen credentials from your business are sitting in an infostealer log on a dark web forum, knowing about it quickly gives you a chance to revoke access before it is used. ClickFix attacks are becoming harder to spot and easier for hackers to scale — the businesses that respond fastest will be the ones that come out the other side intact.
Run a free dark web and credential audit for your business at breachrr.com/audit to find out what may already be exposed.
Want to see if your company is exposed?