Malware · 75 days ago

Paste-to-Run Attacks Break Endpoint Assumptions

ClickFix works because the user becomes the execution step. That means a normal-looking paste into a trusted prompt can look legitimate to AV and EDR, even though it is the handoff that runs the malware.

ReliaQuest says this tactic dominated malware delivery from March 1 to May 31, 2026, and it spread from Windows into macOS. The macOS change matters because attackers moved from Terminal to Script Editor after Apple added paste-time warnings in Terminal, and the payloads included Deepload and AMOS.

For defenders, the shift is not just a new lure. It shows the technique can move across platforms and around vendor warnings as long as users can paste commands into a trusted workflow.

Timeline

• Jul 1 Reported by Dark Reading
• Jun 30 Reported by Infosecurity Magazine

Sources

2 sources covering this story

• Dark Reading Jul 1

  And the Winner in Dominant Malware Delivery? ClickFix

  Researchers say the highly effective social engineering technique is no longer the exception for malware attacks — it's now the rule.

• Infosecurity Magazine Jun 30

  ClickFix Now Cybercriminals' Favorite Malware Delivery Technique

  ReliaQuest report warns of a surge in ClickFix social engineering attacks against Windows and macOS users

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-07-02

Editions

• Briefing for 2026-07-02

Related stories

• Signed Installers Hide a Remote-Control Malware Network