ClickFix malware delivery shifted to terminal paste commands on 5,400 compromised sites by September 2026

Attackers replaced resource-heavy infrastructure—SEO portals, signed installers, rotating domains—with user-executed terminal commands. BlueVoyant documented the change in the Lorem Ipsum campaign, noting that voluntary paste operations now substitute for Microsoft-trusted certificates. Cisco Talos identified public Google Sheets documents as additional command hosts, while Netskope recorded 5,400 beaconing sites in one campaign cluster. Jamf and independent researchers recorded macOS variants that bypass Gatekeeper by invoking the same paste sequence. Sandworm infrastructure on blockchain contracts and Netskope-tracked campaigns demonstrate parallel adoption across state and criminal actors. uBlock Origin and BlockBlock now intercept the ⌘+V step on both platforms, yet adoption remains uneven. Operational impact centers on reduced attacker overhead and broader targeting. Defenses that monitor paste-to-terminal or block known script patterns provide immediate containment without new signatures. Continued expansion is expected as long as public web services remain writable by compromised accounts.