Detecting ClickFix on shared AI pages before cloud session reuse

Contribution

This post adds a cross-plane detection sequence for ClickFix pages hosted on public generative-AI share links. The sequence joins a visit to a shared AI transcript with user-started command execution, process-bound network retrieval and any later cloud-session reuse, rather than blocking an entire AI service or waiting for a known malicious URL.

The pattern

A public AI conversation now has two properties attackers value: it sits on a domain many organisations allow, and it presents generated instructions in a format users have been taught to treat as helpful. Google Threat Intelligence Group (GTIG) reported the first observed campaign to abuse public conversation sharing across services including Gemini, ChatGPT, Copilot, DeepSeek and Grok as trusted instruction hosting. The activity was first observed in December 2025 and used the established ClickFix technique to make victims run attacker-supplied commands themselves.

The trick is not a model breaking out of a sandbox. An attacker prepares a malicious command, asks a service to frame that command as the solution to an ordinary computer problem, then publishes the response as a shareable conversation. Malvertising or another traffic source sends the victim to that page. The victim copies the command into a terminal, which retrieves and installs malware under the victim's own account.

GTIG observed Windows and macOS lures. Its macOS examples delivered variants of ATOMIC, an information stealer able to collect browser data, cryptocurrency wallets, system information and files from Desktop and Documents. The report describes public sharing as the first stage of instruction, not the payload host, and notes that user initiation plus built-in commands can make the chain harder for security software to block.

That distinction matters for detection. A deny-list entry for one shared transcript expires as soon as the attacker publishes another. Blocking Gemini, ChatGPT or Copilot in full would also remove legitimate work and produce pressure for exceptions. The useful invariant is the transition from a browser visit to an unusual command interpreter, followed by retrieval from a different destination.

Microsoft's TerminalFix campaign analysis shows how much can happen after the paste. Its observed lure used a compromised website and a fake Cloudflare verification page rather than an AI share page, so it is corroboration for the execution half of the chain, not proof that the two campaigns are one operation. The victim pasted a PowerShell command that downloaded a ZIP archive, extracted it under C:\ProgramData, and launched a batch file.

The later stages used a legitimate signed binary to sideload a malicious DLL, retrieved payload fragments hidden in PNG images, created Run-key and scheduled-task persistence, and gathered Active Directory information. The chain ended in a Python implant that opened an encrypted WebSocket reverse tunnel. Microsoft did not observe the possible downstream lateral movement, privilege escalation or data theft, which is an important limit: reverse-tunnel capability is not evidence that each possible action occurred.

Unit 42's research into generative-AI phishing bait supplies a second view of the hosting problem. Its telemetry found attackers using AI website builders, writing tools and chatbots for phishing, with real landing pages linking onwards to attacker-owned credential sites. Website generators were the largest category in its observed misuse set. A shared transcript and an AI-built landing page differ technically, but both break a common control assumption: the first page can belong to a reputable service while the damaging action happens elsewhere.

The combined pattern is a trusted-host hand-off. Reputation works at the wrong boundary if the SOC treats the first domain as the whole incident. Detection has to follow the user and device across the hand-off.

Why it matters to cloud defenders

ClickFix begins in browser and endpoint telemetry, but its useful payoff often sits in cloud identity. A browser-data stealer can recover session material, saved credentials and access to web applications. A reverse tunnel can give an operator a route back through a managed workstation. Neither outcome proves that AWS, Azure, GCP or SaaS accounts were accessed, but both create a reason to inspect those control planes quickly.

Cloud teams are especially exposed where administrators use the same workstation for web research, terminal work and privileged consoles. A command pasted from a shared transcript inherits the user's network reach and local credential context. If that user also holds cached access to Entra, Google Workspace, AWS IAM Identity Center or an administrative SaaS session, the endpoint incident can cross into the control plane without another exploit.

The public-share host also complicates proxy policy. Many teams allow conversational AI domains for engineering, legal or support work. A host-only allow-list cannot distinguish a normal question from a published transcript containing paste-and-run instructions. Full content inspection may be unavailable because of TLS, privacy controls or unmanaged browsers, and shared-page routes can change.

This makes device and identity joins more useful than page classification alone. The SOC does not need to decide whether every AI response is safe. It needs to identify when an approved web visit is followed by a command path that normal browsing should not produce, then check whether the same identity appears in cloud audit logs from a new source.

Cloud-hosted desktops and developer workstations deserve particular attention. An ephemeral build runner should not browse public conversation links at all, so any such request is notable. A developer laptop may browse them often, but should not normally start a shell that immediately downloads an archive from an unrelated new domain. Different baselines, same sequence.

The detection can also survive a change of lure. GTIG's pages presented troubleshooting instructions. TerminalFix presented a fake verification step. The words and host change, but the user-mediated boundary remains browser, terminal, retrieval, execution. That is harder for an attacker to remove because ClickFix depends on the victim crossing it.

ATT&CK mapping

The entry is T1189, Drive-by Compromise. The victim reaches malicious instructions through advertising, a compromised page or another redirect, and the browser visit creates the first observable event. A shared AI transcript is unusual hosting for the lure, but it does not create a new initial-access technique.

The pasted command maps to T1059, Command and Scripting Interpreter. Windows examples may use PowerShell or Windows Terminal; macOS examples may use Terminal with zsh or bash. The important behaviour is user-started interpreter execution that contains retrieval, decoding or execution logic shortly after the browser event.

Payload retrieval and the reverse tunnel fit T1071.001, Application Layer Protocol: Web Protocols. Microsoft's observed chain used HTTPS for staged downloads and an encrypted WebSocket channel for the tunnel. HTTPS alone is ordinary, so process ownership, destination history and the preceding shell event carry the signal.

The data payoff needs careful attribution. GTIG states that the delivered ATOMIC variants can collect browser data and local files, which puts Credentials from Password Stores, T1555, and Data from Local System, T1005, in scope for endpoint investigation. List them as observed malware capabilities, not as proof that every victim lost those items.

T1078.004, Valid Accounts: Cloud Accounts belongs at the end only when cloud or SaaS logs show the compromised user's identity used after the endpoint sequence. A new cloud login, API token exchange or administrative action is evidence of the pivot. The possibility of browser-session theft by itself is not enough to assert cloud-account use.

This mapping keeps the chain honest: T1189 for arrival, T1059 for the user's execution, T1071.001 for retrieval or tunnel traffic, then T1078.004 only if the cloud side records credential or session reuse. Supporting behaviours such as DLL sideloading, scheduled tasks and Run-key persistence should be mapped from the actual endpoint evidence rather than copied into every ClickFix case.

Detection guidance

Build the primary alert as a sequence keyed by device and user. Use secure web gateway, browser or DNS telemetry for the first event; endpoint process and network events for the second and third; then identity-provider and cloud audit logs for escalation. A practical correlation window is short enough to preserve causality but wide enough for a user to read the page and follow its instructions. Start with 15 minutes and tune from observed user behaviour.

The first event is a visit to a public conversation or published-content route on a generative-AI service. Maintain the route patterns separately from the base-domain allow-list, because a normal authenticated chat session and an anonymous public share are different surfaces. Record the full URL where policy allows, the referrer, device identity, user identity and browser process.

Do not alert on that visit alone. Raise the score when the referrer is advertising infrastructure, a newly seen domain or a redirect chain unrelated to the user's work. A direct visit from an internal bookmark or an approved knowledge base is weaker evidence. If full URLs are unavailable, retain host, path category and redirect metadata at the proxy.

The second event is an interactive command interpreter on the same device and user. On Windows, watch powershell.exe, pwsh.exe, cmd.exe, wt.exe, mshta.exe, wscript.exe and cscript.exe. On macOS, watch Terminal, zsh, bash, osascript and curl when they appear in a user session shortly after the web event.

Command-line content can add confidence without becoming the sole detector. Useful terms include Invoke-WebRequest, DownloadString, curl, wget, archive extraction, base64 decoding and execution from user-writable directories. Microsoft observed a PowerShell retrieval followed by extraction under C:\ProgramData; treat that path as campaign context, not a universal ClickFix requirement.

The third event is process-bound network retrieval. Join the interpreter or its child process to a destination absent from that device's recent history, especially when it downloads an archive, script or image and then starts another process. HTTP POST requests for images followed by local binary creation deserve attention because TerminalFix reconstructed payloads from PNG content, but image traffic without the process chain is far too broad.

A sequence can be expressed as this field contract:

1. web.device_id = process.device_id and web.user_id = process.user_id.
2. web.category = public_ai_share within 15 minutes before an interactive shell.
3. The shell or a child process opens a connection to a destination outside the AI service's domain set.
4. The process writes or executes a file, creates persistence, or launches a signed binary from a user-writable directory.
5. Escalate if the same user later appears in cloud identity logs from a new IP, ASN, country, device identifier or client signature.

Keep the fifth step as an escalation, not a prerequisite. Waiting for cloud reuse throws away the chance to contain the endpoint first. When it does occur, query Entra sign-in logs, Google Workspace login and token events, AWS IAM Identity Center records, CloudTrail management events and SaaS audit logs from the time of the browser visit onwards.

False positives cluster around legitimate technical support. An engineer may open a shared answer, copy a package-install command and run it. Suppress only when the command retrieves from an approved package registry or vendor domain, the package signature or digest verifies, and no unrelated child process or persistence follows. A broad exception for developers would remove the population most likely to paste technical commands.

Another benign case is an internal help desk sharing a transcript. Prefer a signed internal knowledge base and approved scripts over public conversation links. Where public links remain necessary, tag sanctioned senders and destinations, but keep the endpoint execution join active. A trusted sender can still forward a poisoned page or have an account compromised.

Test the analytic with controlled browser-to-shell exercises on Windows and macOS. Include a normal shared AI page with no terminal action, an approved installation command, a retrieval from an unknown test domain and a simulated cloud login from a new test source. The detector should ignore the first, retain low-severity context for the second, alert on the third and escalate the fourth.

What to do now

1. Separate public AI share routes from ordinary AI-service traffic in proxy and browser telemetry. Do not block a whole service because one publishing surface is abused.
2. Correlate those visits with user-started shells and process-bound retrieval on the same device. Start with a 15-minute window, then measure normal support and developer workflows before changing it.
3. Page on the sequence when an unrelated destination, writable-directory execution, DLL sideload, persistence or reverse-tunnel traffic follows. Use Microsoft's TerminalFix indicators for that campaign, but keep the behavioural sequence independent of those indicators.
4. After a hit, isolate the endpoint and revoke relevant browser sessions, refresh tokens and developer credentials. Search cloud and SaaS audit logs for the same identity from new infrastructure before restoring access.
5. Move internal troubleshooting commands into reviewed scripts or a signed knowledge base. If staff must paste commands, require them to verify the publisher and destination rather than trusting the page's host.

GTIG's AI threat tracker establishes that attackers have used public AI sharing as ClickFix hosting. Microsoft's TerminalFix research supplies the current post-paste execution and tunnel chain, while Unit 42 shows the wider shift towards reputable AI services as phishing infrastructure. Together they point to one defensible control: follow the transition between trusted page, terminal and cloud identity instead of betting on URL reputation alone.