ClickFix Fake AI Installers Target Windows Users: How to Spot Clipboard-Swapping Scams

One thing to know up front: the report that kicked this off was sponsored and written by Push Security, which sells a browser security product. Push's detection percentages describe its own customers, not the whole internet. Its trial offers and case study are sales copy and are left out here. Still, the main trend is backed by two parties with nothing to sell in this story: Microsoft's 2026 Digital Defense Report and a separate analysis from sandbox vendor ANY.RUN.

The numbers: Microsoft's data backs up the hype​

Start with Microsoft, since it doesn't sell browser security. Between February and early May 2026, Microsoft Defender observed ClickFix-style attacker-supplied commands executed on more than 1.1 million unique devices, roughly an eightfold increase. A summary of the report from The Ruling Desk gives the weekly curve: weekly volume went from about 38,000 devices in the first week of February to about 310,000 in the first week of May.

Push's sponsored piece adds two more Microsoft figures that weren't on Microsoft's public summary page. Secondary write-ups of the full report do back them up:

• An analysis of the report says ClickFix activity increased approximately 23 times between December 2025 and May 2026, with malware following most malicious copy-and-paste intrusions.
• A breakdown aimed at financial institutions reports that in Microsoft Defender Experts notifications, the follow-on to a ClickFix intrusion was almost always malware (96.3%).
• The report also notes a newer variant, FileFix, has users paste the command into the File Explorer address bar instead.

For context, the 2026 edition was published on October 1, 2026 and covers July 2025 through June 2026. One more line from Microsoft explains why ClickFix matters: user execution accounted for 30% of observed initial access, ahead of valid accounts at 20%.

Push's own figures come from its own detections:

• ClickFix averaged 52% of Push's detections through Q2 2026, overtaking adversary-in-the-middle and device code phishing for the first time. It hit 67% in August.
• About half of all browser attacks Push intercepts arrive through channels other than email.
• For ClickFix the share is higher: Push says four in five ClickFix pages it intercepted in 2026 were reached from search engines, through compromised sites, malvertising and SEO poisoning.
• In Push's latest quarterly snapshot, AI-themed InstallFix and LLMshare attacks made up about 5% of everything it detected.

Summary: ClickFix grew about eightfold on Microsoft's numbers between February and May 2026. Push's larger percentages are one vendor's view and point in the same direction.

Why AI tools make such good bait​

Push argues that AI adoption has spread two habits that suit ClickFix operators very well.

Habit one: installing from the terminal. Claude Code and similar tools install with a one-line terminal command. People who never opened a command line before now paste commands from web pages as a normal part of trying a new tool. Push's March research made the same point: tools like Homebrew, Rust, nvm and Bun all ship "curl to bash" one-liners, and the whole security model comes down to trusting the domain.

Habit two: searching instead of going direct. Lots of people reach their AI tools by typing the name into a search engine. Employees also adopt new AI apps faster than security teams can approve them. Both habits land users on a search results page, which is where ClickFix delivery happens.

Here's what changes. A classic ClickFix page has to invent a reason for you to paste something, like a fake CAPTCHA or error. An InstallFix victim already plans to run a command, so the attacker only has to swap it. Push's claim that this lowers user suspicion is reasonable, but it's a judgment about behaviour, not a measured result. And none of this means the AI tools themselves are unsafe. The risk is in how people find and install them.

Independent check: ANY.RUN's fake-AI count​

ANY.RUN's research, published separately from Push, points the same way:

These are sandbox analyses, not unique victims, so treat them as a sign of the trend rather than an infection count. ANY.RUN also found fake install pages for GitHub Copilot CLI, Ollama and OpenClaw. In one fake Ollama variant, the page installs the real OllamaSetup.exe so the victim gets a working tool while a stealer runs alongside it. On Windows, the fake "Download Claude" pages told visitors to press Win+R, open PowerShell, paste and press Enter. The chain used mshta.exe and encoded PowerShell, and only built-in Windows programs ran.

InstallFix: the page shows the real command and copies a fake one​

Push first described InstallFix in March 2026: cloned install pages for Claude Code, Codex and NotebookLM, pushed through search ads. NotebookLM doesn't even have a desktop installer. The Windows payload in that first campaign started through cmd.exe, which launched mshta.exe to fetch remote content, and Push identified the malware as the Amatera infostealer.

The newest cluster Push analyzed is sneakier:

1. A Google search for "claude mac" returns a sponsored result that shows bing.com as its domain.
2. The ad passes the visitor through Bing's own click-tracking redirect to a compromised retail website.
3. That site forwards the visitor to a fake "Download Claude" page.
4. Two cloaking checks, one on the compromised site's server and one script on the fake page, send anyone who didn't come through the ad to a harmless page or a 404.
5. The page shows Anthropic's real install command, but its copy button puts a different command on the clipboard.
6. That command first prints a real claude.ai URL in Terminal. It then decodes a hidden URL and pipes the downloaded script straight into the shell without saving it to disk.

So a careful user who reads the page and then watches Terminal sees Anthropic's domain both times. Any security tool that judges a page by its visible text gets fooled the same way. This sample targeted macOS, but Push says the trick is already showing up on other lures, and ClickFix kits copy each other's features quickly.

LLMshare: the lure lives on ChatGPT or Claude itself​

LLMshare, which Push reported in May 2026, abuses the sharing features of AI chatbots. Attackers create shared chats and Artifacts on ChatGPT and Claude with malicious install steps or links, then promote them through search ads. Because the lure sits on chatgpt.com or claude.ai, tools that rely on domain reputation have no reason to flag it.

The latest version uses custom GPTs. In the case Push analyzed, the GPT answered every prompt with a fake "Service Availability Notice" linking to a Google Sites page that served a Windows ClickFix payload. It had more than 10,000 conversations when Push observed it. In a related chain Push linked to earlier reporting by Huntress and Island, the victim pasted a PowerShell one-liner into the Run dialog. It turned off execution policy for that session, downloaded a script from an IP address written in decimal form, and ran it from the temp folder.

A custom GPT works better than a static shared chat because you use it normally before the trap appears. By the time the "outage" message shows up, everything has behaved the way you expected.

Why defences keep missing it​

The reasons, sorted from well supported to the vendor's own reading:

• Email security never sees it. If you reached the page from a search result, there was no email to scan.
• Domain reputation is fooled. Blocklists see bing.com, chatgpt.com, sites.google.com, or a real site that has been compromised.
• EtherHiding. Push says the main kits store their settings in a smart contract on a public blockchain, so there's no server to take down. The operator can change the payload URL on every compromised site with one transaction.
• Endpoint gaps. The command runs in a legitimate shell, often entirely in memory. Push counts 84 command forms across more than 20 programs, including PowerShell, mshta, rundll32, msiexec and certutil. That makes detection harder but doesn't make EDR useless. Push's claim that unmanaged Macs, contractor laptops and personal devices have "no protection at all" overstates things, though protection there is often thin.
• Hard to investigate afterwards. Many lures only fire under specific conditions. Push says a December 2025 ConsentFix campaign linked to APT29 only showed its lure to visitors who entered an email address on the attacker's target list. Once an analyst opens a reported URL directly, it may load clean.

What Windows users and admins can do​

For everyone:

1. Open AI tools from a bookmark or the vendor's official documentation, not a sponsored search result.
2. Before you run a command, paste it into Notepad first and read what's actually on the clipboard. What the page shows can differ.
3. Be wary of commands that decode base64, fetch remote scripts, use irm ... | iex, or turn off PowerShell execution policy.
4. No real CAPTCHA, outage notice or "verification" step will ever ask you to press Win+R and paste something.
5. Treat shared chats and custom GPTs as content made by strangers, not as an endorsement from OpenAI or Anthropic.

For IT admins:

• Publish an approved AI tool list. ANY.RUN recommends listing approved tools with their official sources (vendor site, winget, Homebrew or the vendor's package) and installing them through MDM or a software portal.
• Restrict risky Windows programs. ANY.RUN also suggests limiting mshta.exe, wscript.exe and unsigned PowerShell for standard users with AppLocker, WDAC and attack surface reduction rules.
• Don't rely on blocking Win+R alone. Push points out that there's no built-in Group Policy to disable the Win+X menu. Shells are also reachable through Start search, File Explorer's address bar and Task Manager. Blocking the Run dialog helps, but it's one layer, not a fix.
• Watch more than email. Search ads and browser activity are now main delivery routes. When investigating a reported page, try to recreate the victim's original search or ad path, because cloaking may hide the lure from a direct visit.

Bottom line: ClickFix is huge by Microsoft's own count, and the AI install craze has given it its most believable cover story yet. One habit beats most of these lures: never paste a command you haven't checked against the vendor's official instructions, and don't believe the text a page shows you over what's actually on your clipboard.