IT Myths Debunked, Part 2. The scariest phishing message of the year did not come by email. It showed up inside a chat window the user already trusted…and asked for help.
ESET’s latest threat report counted a 108% jump in ClickFix detections between the second half of 2025 and the first half of 2026, and it is the kind of attack that makes security training feel out of date. There is no attachment, no download prompt, and no warning from the browser, because the victim installs the malware personally. A page says to press a few keys, paste something, and hit enter, and that is the whole attack.
What changed this year is where the instruction shows up, which brings us to the myth.
The Myth: “If It Appeared Inside the Tool I Was Already Using, It Is Legitimate”
Most awareness training is built around spotting a bad sender: check the address, hover over the link, look for the typos and the urgency. None of that applies when the instruction appears in the middle of a conversation you started yourself, inside an application you open every day.
What Happened
On October 8, 2026, an IT administrator at a managed services provider described an incident on r/msp that his team had investigated that same day. A user at a client organization was working in ChatGPT on an investor presentation when the conversation displayed a message saying the service was seeing elevated automated traffic and needed additional security verification to continue. It included a link, it was signed “OpenAI Security Team,” and it appeared as an assistant response inside the real chatgpt.com interface.
The user followed the link, and the page that loaded did four things:
- Copied a PowerShell command to the clipboard without being asked
- Told the user to press Win + X, open Windows Terminal, press Ctrl + V, and press Enter
- Would have pulled remote content from an attacker-controlled domain and executed it
- Got stopped by endpoint protection, twice, roughly 88 seconds apart
The MSP’s first theory was a phishing email with a SharePoint link, and the investigation ruled that out. What they could establish was narrower and stranger:
- A legitimate ChatGPT conversation, with no suspicious plugins, custom skills, or browser extensions
- A message presented as an assistant response, directing the user to a malicious site
- A site that told the user to run malware
The administrator was careful to say he was not claiming OpenAI’s infrastructure was compromised, and that whether this was prompt injection, conversation manipulation, or an unsafe model response had not been determined. None of that matters to the person in the chair. They had no reason to doubt the message, because it was sitting inside ChatGPT.
How It Works
The page the user landed on is the standard ClickFix kit, and Microsoft’s August write-up of a campaign it named TerminalFix shows what the same mechanics do when nothing stops them:
- A fake “Verify you are human” checkbox silently copies a PowerShell command to the clipboard, and the page tells the user to paste it into Windows Terminal.
- The pasted command prints reassuring status messages on screen while it downloads the real payload in the background.
- Once running, it looks for domain admin accounts, backup servers, and mail systems, sets itself to re-launch every hour, and opens an encrypted tunnel so the attacker can reach the rest of the network through that one machine.
The lure can sit almost anywhere:
- Netskope traced one campaign to more than 5,400 compromised websites, most of them small-business WordPress and e-commerce sites, the kind a Tampa contractor or an Orlando law office runs
- CTM360 counted more than 17,000 infected URLs in a separate analysis
- ESET now tracks a variant it calls AI-fix, built specifically to exploit trust in generative AI, which is where the ChatGPT incident lands
Why People Fall For It
Older lures asked you to click something, which felt like a risk. This one asks you to complete a task, which feels like competence, and the people who think of themselves as careful are the ones most likely to follow the steps exactly as written. Put the instruction inside a tool the person already trusts and the usual red flags never appear, because there is no sender to check and no link to hover over.
That is also why this belongs in the same conversation as AI data-handling rules. If a team is being handed new AI tools, it needs to hear that a real one will never ask for a keyboard shortcut to prove anything, and that conversation is easier to have before the tools go live than after.
The One Rule Worth Teaching
Trying to recognize every new lure is a losing game, because the lure changes monthly and the last step never does. Every one of these attacks ends the same way, with a person pasting a command they did not write into Run, Terminal, or PowerShell.
So the rule is short enough to put on a sticky note: no legitimate service will ever ask you to paste a command into your computer to prove you are human. Not Microsoft, not Google, not your bank, and not an AI assistant. If a verification step involves a keyboard shortcut, it is not a verification step.
Two things on the IT side make the rule stick:
- Restrict the Run dialog and PowerShell for standard users, which is Microsoft’s own guidance and removes the final step for most of the office
- If someone has already pasted the command, treat it as a full credential compromise and start there, because whatever ran had every permission that person has
Where GiaSpace Fits
We cover this pattern in client security training, configure endpoint protection to catch exactly this execution chain, and lock down the Run dialog for the accounts that never needed it. We would rather your team hear about it on a Tuesday than discover it on a Saturday.
→ Schedule a Security Review with Rob Giannini, our CEO & Founder
