ClickFix malware campaign leverages fake AI tools and chatbot platforms as lures
ClickFix
Cybercriminals are using fake AI software installers, malicious search results, and chatbot platforms in ClickFix campaigns to trick users into executing malware. These lures leverage the popularity of AI tools to evade traditional defenses.
- first report
- 21 Oct 2026
- last update
- 21 Oct 2026
Timeline · 1
Sources · 1
News and write-ups
- 2026-10-21ClickFix has never been bigger, and AI tools are its most convincing lure yetBleepingComputer · bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-a
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- AI role
- AI-enabled attack
- categories
- AI phishing / social engineering
- severity
- 3 · Confirmed exploitation
- targets
- Individuals
- owasp llm top 10
- no entry for these categories
- mitre atlas
- AML.T0052 Phishing
- dates
- happened 21 Oct 2026 · first reported 21 Oct 2026
- origin
- News & research feeds
- record
- confidence 0.90 · created 2026-10-21 17:47Z · updated 2026-11-05 02:33Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# ClickFix malware campaign leverages fake AI tools and chatbot platforms as lures https://gcdradar.vercel.app/incidents/clickfix-malware-campaign-leverages-fake-ai-tools-and-chatbo · AIR-2026-1454 · closed 2026-11-04 - Lane: Breaches & attacks - Severity: 3 (Confirmed exploitation) - Fix status: No fix needed - First reported: 2026-10-21 - AI role: AI-enabled attack - Products: ClickFix ## Summary Cybercriminals are using fake AI software installers, malicious search results, and chatbot platforms in ClickFix campaigns to trick users into executing malware. These lures leverage the popularity of AI tools to evade traditional defenses. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-10-21: ClickFix has never been bigger, and AI tools are its most convincing lure yet (https://bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet) ## Sources - 2026-10-21 BleepingComputer: ClickFix has never been bigger, and AI tools are its most convincing lure yet https://bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveCEO impersonation tooling CEO-spoofing scammers used AI to help steal more than $100 million
Breaches & attacks · Real loss · since 6 Nov 2026
AI - closedWeb Services Agents Agent-to-Agent Synthetic Social Engineering on the Web
Research · since 27 Oct 2026
AI - closedThreat actors deploy open-weight AI models for mass attacks
Breaches & attacks · Exploited · since 23 Oct 2026
AI - closedPhishGen Evaluation of LLM-Driven Phishing Website Generation
Research · since 23 Oct 2026
AI - closedClaude Fake Web3 Accelerator Uses Malicious npm Packages to Distribute Malware
Breaches & attacks · Exploited · since 19 Oct 2026
AI - closedChatGPT Fake Claude and ChatGPT campaigns use ClickFix tactics against developers
Breaches & attacks · Exploited · since 16 Oct 2026
AI