ClickFix攻击技术演变为大规模恶意软件传播方式

ClickFix攻击已从小众手段演变为主流的恶意软件传播工具，正在大规模感染Windows和Mac用户。1这种攻击方式的实施链条简洁有效：攻击者入侵合法网站，植入虚假的CAPTCHA验证覆盖层，诱导用户执行单行终端命令，从而实现感染。1因其简洁性和有效性，该技术已被几乎所有恶意软件推销者采用，甚至包括克里姆林宫支持的黑客组织。1

网络安全研究人员指出这一威胁规模正在迅速扩大。据报道，"Reddit充斥用户遭受感染的报告"，1同时"合法网站随处可见遭到入侵用于投放虚假CAPTCHA提示"。1

ClickFix has evolved from a niche attack technique into a mainstream malware distribution method, with threat actors now using the tactic to rapidly compromise both Windows and Mac systems 1. The attack mechanism is remarkably simple: hackers breach legitimate websites and inject fake CAPTCHA overlays that trick users into executing a single-line terminal command, which then installs malicious software 1.

The technique has achieved widespread adoption among cybercriminals because of its simplicity and effectiveness 1. According to security researcher Kevin Beaumont, the attack has become so prevalent that "Reddit is becoming post after post after post of people getting their computer infected via ClickFix" 1. Beaumont also noted that "legit websites everywhere [are] getting hacked to serve the fake captcha prompts" 1, highlighting how attackers are systematically compromising legitimate online properties to deliver their fake CAPTCHA payloads.

The threat landscape has expanded further with reports indicating that Kremlin-linked hacking groups have begun adopting the ClickFix technique 1, demonstrating how quickly state-sponsored actors are incorporating it into their operational arsenal. Nearly all malware vendors have already incorporated ClickFix into their distribution strategies 1, signaling that this attack vector is likely to remain a significant security concern.