ClickFix moves into the browser and onto WebDAV, Cisco Talos finds – SiliconANGLE

Cisco Systems Inc.’s Talos Threat Intelligence group today detailed two ClickFix campaigns that push the technique past the copy-and-paste PowerShell prompt it is known for, one that never touches the operating system at all and one that ends in a stealer plus whichever follow-on payload the operators choose to task.

ClickFix emerged in 2024 and has become known for one move: a page claiming some check has failed and offering a command for the visitor to paste into the Windows Run dialog or a Mac terminal. Having the target run the code sidesteps the download warnings and email filtering that catch attachments. The technique has spread quickly since, turning up last month in a fake OpenAI Codex installer aimed at Mac users that Cato Networks Ltd. documented.

In the first of the campaigns Talos detailed, the target is never asked to run anything against Windows. The lure walks the victim through pasting JavaScript into the Chrome address bar, or in a later version installing it…