--- title: "And the Winner in Dominant Malware Delivery? ClickFix" url: https://daily.dev/posts/and-the-winner-in-dominant-malware-delivery-clickfix-bnaaccteu source_url: https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix type: article source: "Dark Reading" published: 2026-07-01T20:08:43.741Z updated: 2026-07-01T20:09:15.503Z tags: ["security", "cyber", "malware"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # And the Winner in Dominant Malware Delivery? ClickFix **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary ClickFix, a social engineering technique first observed in 2024, has become the dominant malware delivery method according to ReliaQuest research covering March–May 2026. The tactic tricks users into copying and pasting malicious commands into system dialogs, bypassing traditional file scanning and email defenses. Key findings include ClickFix expanding to macOS via applescript:// links that bypass Apple's Terminal paste warnings, attackers using AI-generated obfuscation in loaders like 'Deepload', and a notable shift toward targeting developers via malvertising campaigns impersonating tools like 'claude code install' and 'homebrew install'. In confirmed cases, exposed npm and Bitbucket tokens were found on compromised developer machines. ClickFix now accounts for nearly 28% of defense-evasion activity and is evolving into a modular post-exploitation launchpad. Defenders are advised to train users, simulate lures, and monitor for anomalous command sequences rather than blocking developer tools outright. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ClickFix may be the biggest security threat your family has never heard of](https://daily.dev/posts/clickfix-may-be-the-biggest-security-threat-your-family-has-never-heard-of-p29pgiik1) · Ars Technica · 0 upvotes · 0 comments - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/and-the-winner-in-dominant-malware-delivery-clickfix-bnaaccteu)