ClickFix
A social engineering attack technique that uses fake human-verification pages to trick users into pasting and executing malicious commands in the Windows Run dialog. The method plants malware without writing files to disk, classifying it as a fileless attack approach.
Timeline (last 90 days)
ClickFix is a social engineering attack technique that tricks users into copying a command and pasting it into a system Run dialog or terminal to execute it, thereby downloading and executing a malicious payload.
The key principle for defending against ClickFix is: any webpage that asks you to copy a command and paste it into a terminal or Run dialog to fix a problem or complete a verification is almost certainly an attack signal, and the page should be closed immediately.
The ClickFix technique has been used to distribute information-stealing trojans, remote access trojans, and ransomware precursor payloads.
The commands executed via ClickFix are often obfuscated PowerShell or mshta instructions that pull the next-stage malicious payload from a remote CDN; because the download and execution occur within a system process rather than a browser sandbox, they can bypass protective layers such as SmartScreen.
Common trigger scenarios for ClickFix include disguising as a CAPTCHA human verification prompt, a browser missing-font notification, or a fake Microsoft/Google system error pop-up.
ClickFix was first systematically documented by security researchers in early 2024 and subsequently spread rapidly on a global scale.
ClickFix lures users into pasting and executing malicious commands in the Windows Run dialog through a fake CAPTCHA page.
The ClickFix attack technique allows users to be compromised without needing to download any files throughout the entire process.
ClickFix typically writes a PowerShell or mshta command to the clipboard in the page's background, so that by the time the user clicks the verification button, the clipboard contents have already been replaced.
Any verification operation that requires executing unfamiliar commands in the Run dialog or command line should be regarded as a high-risk signal.
7 more timeline events
All Facts (16)
The key principle for defending against ClickFix is: any webpage that asks you to copy a command and paste it into a terminal or Run dialog to fix a problem or complete a verification is almost certainly an attack signal, and the page should be closed immediately.
50%UnverifiedThe ClickFix technique has been used to distribute information-stealing trojans, remote access trojans, and ransomware precursor payloads.
50%UnverifiedClickFix is a social engineering attack technique that tricks users into copying a command and pasting it into a system Run dialog or terminal to execute it, thereby downloading and executing a malicious payload.
50%UnverifiedThe commands executed via ClickFix are often obfuscated PowerShell or mshta instructions that pull the next-stage malicious payload from a remote CDN; because the download and execution occur within a system process rather than a browser sandbox, they can bypass protective layers such as SmartScreen.
50%UnverifiedCommon trigger scenarios for ClickFix include disguising as a CAPTCHA human verification prompt, a browser missing-font notification, or a fake Microsoft/Google system error pop-up.
50%UnverifiedClickFix was first systematically documented by security researchers in early 2024 and subsequently spread rapidly on a global scale.
50%UnverifiedClickFix typically writes a PowerShell or mshta command to the clipboard in the page's background, so that by the time the user clicks the verification button, the clipboard contents have already been replaced.
50%UnverifiedThe ClickFix attack technique allows users to be compromised without needing to download any files throughout the entire process.
50%UnverifiedClickFix lures users into pasting and executing malicious commands in the Windows Run dialog through a fake CAPTCHA page.
50%UnverifiedAny verification operation that requires executing unfamiliar commands in the Run dialog or command line should be regarded as a high-risk signal.
50%UnverifiedAny web-based operation that asks users to copy and paste commands into a terminal, run box, or command line should be treated with a high degree of suspicion.
50%UnverifiedClickFix bypasses automated system protection mechanisms by having users actively copy, paste, and run commands, because the system treats this as a legitimate user action.
50%UnverifiedClickFix attacks can simultaneously threaten both the Mac and Windows platforms.
50%UnverifiedThe core logic of ClickFix attacks is social engineering, which guides users into executing malicious commands by fabricating seemingly plausible error scenarios.
50%UnverifiedClickFix is a security threat that induces users to personally complete the final step of an attack, rather than relying on a traditional trojan to execute automatically.
50%UnverifiedAttackers bid on keywords for popular software brands, causing malicious ad links to appear above official websites.
50%