ClickFix is a trick rather than one piece of malware: a web page shows a fake error or CAPTCHA and tells you to paste a command into Terminal, and that command installs a stealer such as Atomic Stealer. No real website needs you to paste anything into Terminal; if you already ran such a command, disconnect, change your passwords from another device, and check your LaunchAgents folders.
Last reviewed · 3 sources
Also known as: Click-Fix, FakeFix, ClearFake variant
ClickFix is a social-engineering technique that MITRE ATT&CK lists as User Execution: Malicious Copy and Paste (T1204.004). A page shows a broken CAPTCHA, browser error or system alert and asks you to 'fix' it by pasting a command into Terminal on a Mac or the Run dialog on Windows; the command downloads and runs malware. Microsoft says it has helped customers deal with these campaigns since early 2024, and that in June 2025 one targeted Mac users with Atomic macOS Stealer. Because you run the command yourself, there is no downloaded app for Gatekeeper to check; Malwarebytes reported in March 2026 that macOS Tahoe 26.4 warns before running some commands pasted into Terminal.
Malicious or compromised websites that show fake error dialogs
Fake CAPTCHA pages that ask you to run a 'verification' command
Phishing emails that link to pages with fake browser update prompts
Malvertising that redirects to ClickFix pages
A website asking you to copy and paste a command into Terminal
A CAPTCHA or verification page that needs a shell command
A button that copies a command to your clipboard for you
New plist files in ~/Library/LaunchAgents after following a site's instructions
Turn off Wi-Fi and unplug Ethernet so the payload can't send anything more.
Open Activity Monitor and look for processes you don't recognize, especially ones using a lot of CPU or network. Quit anything suspicious.
Check ~/Library/LaunchAgents and /Library/LaunchAgents for plist files created when you ran the command. Move them to the Desktop rather than the Trash, then restart.
Look in Safari's Extensions settings, chrome://extensions and Firefox's about:addons, and remove anything you don't recognize.
ClickFix commands usually install stealers, so change passwords for email, banking and other important accounts from a phone or another computer.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find everything the payload installed.
Never paste a command from a website into Terminal; legitimate sites don't ask for this
Any page that says your browser needs a 'fix' through Terminal is a scam
An ad blocker cuts down the malvertising that leads to ClickFix pages
Keep macOS updated: newer versions add warnings and XProtect signatures
What it can and can't do
CoreLock can't stop you pasting a command into Terminal. Afterwards, its free scan's startup-items check covers launch items a payload adds, and its Downloads check compares files there against a built-in malware-hash list and 19 YARA rules; neither can promise to catch everything a ClickFix payload installs.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
Stealer — Realst is a macOS information stealer written in Rust. Security researcher iamde...
System Settings › Privacy & Security › Full Disk Access
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
System Settings › Privacy & Security › Input Monitoring
A web page tricks you into running a command on your own Mac. It shows a fake error, a broken CAPTCHA or a system alert, and offers a 'fix' that means pasting a command into Terminal. The command downloads and installs malware, usually a stealer that takes passwords, cookies and crypto wallets.
Not reliably. Gatekeeper checks apps you open, and a pasted Terminal command isn't one. XProtect may recognize a known payload, but new builds often get through. Malwarebytes reported in March 2026 that macOS Tahoe 26.4 warns before running some pasted commands; Apple hasn't documented which.
Disconnect first. Then look in Activity Monitor for unknown processes and in ~/Library/LaunchAgents for new plist files, and change your important passwords from another device. CoreLock's free scan can check startup items and your Downloads folder, but it can't promise to catch everything.
Because it relies on a person running the command, it can get past security tools that would block a downloaded app, Microsoft says. It needs little more than a web page and works on both macOS and Windows.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser