ClickFix is a social engineering attack pattern where victims encounter a fake browser error or CAPTCHA page that instructs them to copy and paste a command into their terminal or Run dialog. The command installs infostealer malware or other payloads. Because the user executes the command themselves, traditional download scanners may not intercept it.
ClickFix campaigns have industrialized through traffic distribution systems and affiliate networks. Hudson Rock tracked the ErrTraffic ecosystem as a major ClickFix distribution operation tied to infostealer deployments.
Read the full investigation in the industrialization of ClickFix.