Case claudefix-shared-claude-chatsAI phishingWorldwide
ClaudeFix: shared Claude chats used to deliver ClickFix malware instructions
Zscaler ThreatLabz describes ClaudeFix, which combines shared Claude chats with the ClickFix paste-and-run technique to deploy malware.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Worldwide
- Target
- Users of shared Claude chat links
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Zscaler ThreatLabz describes ClaudeFix, which combines shared Claude chats with the ClickFix paste-and-run technique to deploy malware.
Impact: Unknown; victim numbers are not stated.
Who triggered it
Actor: Unknown
Attribution: Not stated; ClickFix is described as a widely used technique.
Motive: Malware deployment on victim systems.
How it happened
Attack vector: Shared Claude chats carrying ClickFix instructions that tell victims to paste and run commands to 'fix' a problem.
Root cause: Users trust AI chat content and run pasted commands; shared chats can be abused to host lures.
Timeline
- Reported by Zscaler ThreatLabz
Response
Zscaler ThreatLabz published its analysis.
Current status: Under investigation
Sources (open in a new tab)
- Zscaler ThreatLabz zscaler.com
Cite this case
ClaudeFix: shared Claude chats used to deliver ClickFix malware instructions. AI Threat Watch, case claudefix-shared-claude-chats, Oct 14, 2026. https://aithreat.io/cases/claudefix-shared-claude-chats/
Permanent link: https://aithreat.io/cases/claudefix-shared-claude-chats/