Malware & Tooling

Paste-to-run attacks break endpoint assumptions

ClickFix works because the user becomes the execution step. That means a normal-looking paste into a trusted prompt can look legitimate to AV and EDR, even though it is the handoff that runs the malware.

ReliaQuest says this tactic dominated malware delivery from March 1 to May 31, 2026, and it spread from Windows into macOS. The macOS change matters because attackers moved from Terminal to Script Editor after Apple added paste-time warnings in Terminal, and the payloads included Deepload and AMOS.

For defenders, the shift is not just a new lure. It shows the technique can move across platforms and around vendor warnings as long as users can paste commands into a trusted workflow.

2 sources · Jul 1

Timeline

• Jul 1 Reported by Dark Reading
• Jun 30 Reported by Infosecurity Magazine

Sources

• Jul 1 Dark Reading

  And the Winner in Dominant Malware Delivery? ClickFix

  Researchers say the highly effective social engineering technique is no longer the exception for malware attacks — it's now the rule.

  original

• Jun 30 Infosecurity Magazine

  ClickFix Now Cybercriminals' Favorite Malware Delivery Technique

  ReliaQuest report warns of a surge in ClickFix social engineering attacks against Windows and macOS users

  original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-07-02

Every edition of this story: Paste-to-run attacks break endpoint assumptions

More from today

• Signed installers hide a remote-control malware network