Original statistics
The ClickFix Index
Six measurements of ClickFix activity, computed from this site’s own record, defined in full on the methodology, and published under CC BY 4.0.
- Statistics as of
- 2026-10-11
- Published campaigns
- 61
- Indicators on record
- 2,045
- Sources credited
- 30
- Licence
- CC BY 4.0
1 · Median observed domain lifetime
Not yet measurable
— · 288 domains carry both dates
Days between the first date any source we hold reports observing a domain and the most recent date any source or re-check did.
Read it as a lower bound: live hosts have no end date, and we observe on report dates rather than continuously. How it is computed.
- 25th percentile
- 0 d
- 75th percentile
- 16 d
- Longest observed
- 658 d
- Seen on one day only
- 61.8%
Most of the 288 domains carrying both dates were seen on a single date, so the median across them is zero. A zero there measures how seldom anyone has looked twice, not how long a domain lives, so we withhold it until re-checking moves it off zero.
2 · New ClickFix domains observed per week
Each domain is counted once, in the week it entered the record — not once per report that mentions it.
The last 12 weeks, as numbers
| Week commencing | New domains | Relative size |
|---|---|---|
| 2026-06-22 | 0 | |
| 2026-06-29 | 0 | |
| 2026-07-06 | 0 | |
| 2026-07-13 | 0 | |
| 2026-07-20 | 0 | |
| 2026-07-27 | 0 | |
| 2026-08-03 | 0 | |
| 2026-08-10 | 0 | |
| 2026-08-17 | 0 | |
| 2026-08-24 | 0 | |
| 2026-08-31 | 0 | |
| 2026-09-07 | 1 |
138 further domains were first observed before the window opens. 762 domains carry no first-observed date and are counted in no week.
3 · Lure-theme mix
The pretext the page uses to get a command pasted. A campaign can carry more than one, so the shares do not sum to 100.
lure theme recorded for 60 of 61 published campaigns · most common: Fake CAPTCHA verification
| Lure-theme | Campaigns | Share | Relative size |
|---|---|---|---|
| Fake CAPTCHA verification | 29 | 48.3% | |
| Fake browser verification challenge | 12 | 20% | |
| Fake software download page | 6 | 10% | |
| Fake macOS utility or troubleshooting guide | 5 | 8.3% | |
| Technology company impersonation | 4 | 6.7% | |
| AI tool impersonation | 2 | 3.3% | |
| Fake error dialog | 2 | 3.3% | |
| Fake software update notice | 2 | 3.3% | |
| Fake video conference page | 2 | 3.3% | |
| Invoice or payment pretext | 2 | 3.3% | |
| Online marketplace impersonation | 2 | 3.3% | |
| Fake Discord server verification | 1 | 1.7% | |
| Fake document repair prompt | 1 | 1.7% | |
| Fake secure drive portal | 1 | 1.7% | |
| Fake security update notice | 1 | 1.7% | |
| Fake video game download | 1 | 1.7% | |
| Fake Web3 application | 1 | 1.7% | |
| Fake Windows Update screen | 1 | 1.7% | |
| Government agency impersonation | 1 | 1.7% | |
| Hotel guest belongings | 1 | 1.7% | |
| Internet and cable provider impersonation | 1 | 1.7% | |
| Pirated film streaming site | 1 | 1.7% | |
| Spoofed Microsoft Office document | 1 | 1.7% | |
| Tax authority impersonation | 1 | 1.7% |
4 · Target operating-system split
Which platforms each campaign was reported to target. A cross-platform campaign counts under every platform its sources name.
target OS recorded for 61 of 61 published campaigns · most common: Windows
| Target operating-system | Campaigns | Share | Relative size |
|---|---|---|---|
| Windows | 51 | 83.6% | |
| macOS | 17 | 27.9% | |
| Cross-platform | 1 | 1.6% |
5 · Execution-mechanism mix
How the pasted command actually ran — the Run dialog, a terminal, a script host. Recorded as a label, never as a runnable string.
execution mechanism recorded for 57 of 61 published campaigns · most common: Windows Run dialog
| Execution-mechanism | Campaigns | Share | Relative size |
|---|---|---|---|
| Windows Run dialog | 33 | 57.9% | |
| Clipboard injection | 31 | 54.4% | |
| PowerShell | 29 | 50.9% | |
| Terminal paste (macOS) | 12 | 21.1% | |
| mshta.exe | 8 | 14% | |
| PNG pixel-data steganography loader | 4 | 7% | |
| rundll32 DLL run over WebDAV | 3 | 5.3% | |
| Windows Terminal paste-and-run | 3 | 5.3% | |
| BITS transfer download | 2 | 3.5% | |
| DLL sideloading | 2 | 3.5% | |
| Deno runtime running remote JavaScript | 1 | 1.8% | |
| FileFix | 1 | 1.8% | |
| finger.exe payload retrieval | 1 | 1.8% | |
| msiexec installing a remote MSI | 1 | 1.8% | |
| Windows batch script | 1 | 1.8% |
6 · Our own extraction error rate
The rate below is produced by a blind weekly audit and by nothing else: five already-published entries re-checked against their sources by a human with the original assessment hidden. We publish it whatever it says. No entry has been audited yet.
- Measured error rate
- not yet measured
- Entries audited
- —
- Found wrong
- —
- Extractions refused
- 0
“Extractions refused” counts indicator rows a database trigger rejected because their exact string was not in the archived source, so a rising count means the constraint is working. How the audit works.
7 · Use these figures
All of it is CC BY 4.0. Quote the numbers, redraw the chart, sell the article — the conditions are attribution and the date the figures were computed, because they change.
Cite as
ClickFixReport, “The ClickFix Index”, dataset clickfix-index, retrieved 2026-10-11.
https://clickfixreport.com/clickfix-index
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.
Credit line for a chart or a screenshot
<a href="https://clickfixreport.com/clickfix-index">The ClickFix Index</a> — ClickFixReport, CC BY 4.0
Plain text: Source: ClickFixReport, The ClickFix Index, 2026-10-11 — clickfixreport.com/clickfix-index
There is no iframe embed: the chart is plain SVG in the page markup with its credit drawn inside, so screenshot it or rebuild it in your own house style.