Halloween Tricks!
There are a handful of new phishing techniques on the rise that have some deceptively friendly names! ClickFix, InstallFix, and LLMshare are all roughly using the same methods to compromise you, but with different approaches. The overwhelming majority of them are targeting current or prospective users of AI products, so pay close attention if you fall under that umbrella.
Up front, the best ways to mitigate your exposure are also staples of good internet hygiene. Don’t click on any sponsored/advertising links in search engines (or anywhere, for that matter). These are often pushed to the top of the search engine results, and there’s effectively no assurance of legitimacy here. If the web address looks strange, you probably shouldn’t be there. If you’re presented with what looks like the front page for CNN.com but the web address shows up as 324r849f49qa.cnm.info, chances are you’ve found yourself somewhere you shouldn’t be. Lastly, don’t run any commands from the internet if you can’t validate what they’ll do.
ClickFix
This method involves presenting you with a fake CAPTCHA verification. Typically, the legitimate version would show a button to click to prove you’re human and might also ask you to identify pictures of bicycles to train data for Cloudflare’s LLMs. ClickFix takes this a step further, giving you a similar-looking page but with additional instructions that attempt to get you to run a malicious command that was sneakily copied to your clipboard when you clicked the ‘Verify you are a human’ button. The most common calling card here is if it asks you to press Windows Key (W) + R or to open a terminal/command prompt/PowerShell; immediately close the page if you see that!
InstallFix
This one is more targeted towards developers or power users, but still worth mentioning. The malicious party will wholesale clone the install/download page for a known tool (AI tools like Claude Code are hot targets for this), then replace the presented legitimate install commands with their own malicious ones. The biggest mitigations here are making sure you’re on the right webpage (if you’re looking for a Claude product and don’t see Claude in the web address, you’re in the wrong place) and reviewing the commands it’s telling you to run before running them.
LLMshare
