Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

ClickFix campaigns hosting malicious instructions inside shared AI chat transcripts to deliver ATOMIC stealer

AIR-2026-0040 AIR record · 2026-02-gtig-clickfix-ai-share-links
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Uses public sharing feature of generative AI services (Gemini, ChatGPT, CoPilot, DeepSeek, Grok) to host malicious ClickFix instructionscloud.google.com
The record
Disclosed
2026-02-13
Occurred
2025-12
Vendor
multiple
Product
Gemini, ChatGPT, Copilot, DeepSeek, Grok share links
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
Human acted on output — the AI domain only hosted the text; the victim ran the ClickFix command
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Abuse of llm conversation sharing feature
Impact type
Malware distribution, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0012 – Valid Accounts
NIST AI RMF
MEASURE 2.7
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Use secure credential storage; Implement short-lived tokens.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
macOS users socially engineered into pasting attacker commands; ATOMIC infostealer delivered
Capability abused
conversation_sharingtrusted_domain_hosting
Taxonomy & references
OWASP ASI03 Identity and Privilege Abuseclickfixtrusted_domain_abusesocial_engineering
Curator notes
Borderline for this corpus - no agent takes an action - but included because the AI provider's own domain is the delivery infrastructure and the pattern generalises to agent share links. First observed December 2025.
Supporting sources
Cite as
Enkrypt AI. "ClickFix campaigns hosting malicious instructions inside shared AI chat transcripts to deliver ATOMIC stealer". AIR, AIR-2026-0040. https://agentincident.vercel.app/i/AIR-2026-0040/ (accessed 2026-10-19).