CTM360 Report Details ClickFix Evolution From Novelty to Subscription Malware Service

According to a comprehensive global threat report published by CTM360 on September 24, 2026, the ClickFix malware distribution technique has evolved from a novelty in late 2023 into a subscription-based malware service with on-chain infrastructure. The technique has become the most common way attackers gain initial access to enterprise networks worldwide.

ClickFix operates by turning trusted websites into malware traps through social engineering. Attackers compromise legitimate websites and serve content that tricks users into executing commands, typically involving copy-paste instructions that run PowerShell or other command-line tools. The key distinction is that ClickFix does not rely on traditional exploits, malicious attachments, or files stored on disk, making it particularly difficult for conventional security controls to detect.

The report traces the technique's evolution and notes that it now features on-chain infrastructure supporting a subscription model. This structure allows the operation to function as a service, with state-sponsored actors among the user base. The authors emphasize that blocking malicious domains is no longer a useful defense strategy, as the technique leverages trusted websites that users inherently trust.

The findings suggest that organizations must shift focus from domain blocking to user awareness, monitoring for suspicious command patterns, and implementing controls that can detect the social engineering components of the attack rather than relying on technical indicators alone.