ClickFix and its derivatives now account for the majority of browser attacks we detected — an average of 52% through Q2, rising to 67% in August. Microsoft found the same pattern in its own telemetry, recording ClickFix as its top initial access vector at 47% of detections.

What makes it hard to stop is where it comes from. Four in five ClickFix payloads Push intercepted in 2026 reached users through search engines rather than email, served from more than 5,400 compromised legitimate websites. With 84 distinct command variants observed — 34 of them seen only once — there's no signature to match and no domain list to block. Get the full details by reading our ClickFix research report.

Endpoint tools are built around the assumption that malware arrives as a file. ClickFix turns this assumption on its head. The payload is executed by the user through a legitimate system utility, so there is no download to intercept or suspicious process to flag. Web sandboxes and email filters face the same problem when the delivery channel is a malicious ad or a compromised website rather than an attachment.

Browser-native variants like ConsentFix remove even the endpoint execution step, leaving traditional tools with nothing to act on. The attack completes inside the browser session, where most security tools have no visibility.

Unlike traditional phishing, ClickFix lures mimic interactions users encounter legitimately every day — CAPTCHAs, error messages, install prompts — making them harder to train against than a suspicious email.

Push intercepts ClickFix and its variants at the source, before the user interacts with the lure, regardless of delivery channel. It identifies the ClickFix page behavior — across fake CAPTCHAs, error messages, and install lures — as they load in the browser, whether the lure arrives through a search ad, a compromised site, or a messaging platform.

Push also analyzes clipboard contents for malicious commands. When a page writes PowerShell, mshta, curl, or other suspicious commands to the clipboard, Push detects the payload and can block or warn in real time. This clipboard analysis is scoped to malicious actions — legitimate clipboard use is unaffected.

For browser-native variants like ConsentFix, where there is no endpoint activity to detect, browser visibility is the only reliable detection point. Push operates there by default. Because Push operates in the browser, it provides ClickFix detection on unmanaged devices where EDR is absent — contractors, BYOD users, and developer machines with tuned-down endpoint controls.