Threat Intelligence

ClickFix Scams Evolve: Attackers Abuse Trusted Services to Stay Hidden

Dark Reading · 9 Sept 2026

Key Takeaway Train staff to be wary of any pop-up or prompt asking them to copy, paste, or run commands themselves, even if it appears to come from a familiar or trusted source.

Security researchers have identified two separate attacks that show how the ClickFix social engineering tactic continues to evolve. ClickFix scams typically trick victims into running malicious commands themselves, often by presenting fake error messages or verification prompts that ask users to copy and paste text into their computer.

In these newer campaigns, attackers are abusing legitimate, trusted online services as part of their infrastructure. Because these services are widely used and generally seen as safe, this approach helps attackers avoid detection and gives them a more reliable way to keep access to compromised systems over time.

The use of trusted platforms makes these scams harder for both employees and security tools to spot, since the traffic and links involved may not look obviously suspicious.

Summarised by CISO AI from Dark Reading. We link back to every original so you can read it yourself.