Dharani Sanjaiy

A new ClickFix social engineering attack weaponizes AI summarizers. Threat actors hide malicious instructions in documents using CSS obfuscation and prompt overdose. This makes the code invisible to humans but fully readable to AI models. When a user summarizes the content, the AI-generated output delivers the malicious payload, tricking the user into executing ransomware. Organizations must implement content sanitization and user awareness to mitigate this risk.