We recently wrote about ConsentFix, where attackers abuse trusted OAuth flows and trick people into granting access without handing over a password.
ClickFix sits in the same family.
It does not need to break into your computer in the old-fashioned way.
It does not always need a dodgy attachment.
It does not even need the person to type their password into a fake login page.
Instead, it gives them a problem to solve.
A fake CAPTCHA.
A fake browser error.
A fake document issue.
A fake “verify you are human” screen.
A fake Google or Cloudflare verification page.
Even a fake Google Meet-style message claiming there is an audio issue to fix.
Then it gives them a set of instructions that feel technical, but believable.
Press Windows + R.
Press Ctrl + V.
Press Enter.
Job done.
Except the job is not fixing the problem.
The job is running the attacker’s command.
What is ClickFix?
ClickFix is a social engineering technique where attackers trick someone into copying, pasting and running a malicious command on their own device.
That command might open PowerShell. It might use the Windows Run box. Newer versions may use File Explorer, Windows Terminal, Command Prompt or other trusted parts of Windows.
The screen usually looks like a normal problem-solving prompt.
It might say your browser needs checking.
It might pretend a document has failed to load.
It might look like a Cloudflare or CAPTCHA verification page.
It might claim you need to verify you are human.
Recent research from Malwarebytes found ClickFix campaigns using fake Google and Cloudflare verification pages, fake QR code services and Google Meet-style “fix audio driver” lures. The wording changes, but the trick stays the same: get the person to run the attacker’s command for them.
Why it works
ClickFix works because it feels like everyday IT.
Most people have been trained by years of software pop-ups, browser errors and helpdesk instructions to follow steps on a screen.
“Click here.”
“Copy this.”
“Paste that.”
“Run this command.”
To someone who is busy, under pressure or just trying to get to a file or meeting, it can feel like a minor annoyance rather than a cyber attack.
That is what makes it dangerous.
This is not about people being stupid.
It is about attackers designing instructions that look just close enough to normal.
Some ClickFix pages also create pressure. They may use warnings, timers, visitor counts or urgent wording to make the person act quickly. That is deliberate. The less time someone has to stop and think, the more likely they are to follow the steps.
A typical ClickFix attack
A ClickFix attack might look like this:
You click a link from an email, a search result, a malicious advert or a compromised website.
The page shows what looks like a browser check, CAPTCHA, Cloudflare verification or error message.
It tells you something has failed and gives you steps to fix it.
The page quietly copies a command to your clipboard, or tells you to copy one manually.
You are asked to open the Windows Run box, PowerShell, Command Prompt or Terminal.
You paste the command.
You press Enter.
The command downloads and runs malware.
From the user’s point of view, very little may happen.
The page might reload.
The error might disappear.
The verification might appear to complete.
The attacker does not need a dramatic warning message.
They just need the command to run.
What can ClickFix lead to?
ClickFix is not one piece of malware.
It is a delivery method.
That means different criminals can use it to deliver different payloads.
Recent campaigns have been linked to multiple types of malware, including information stealers, loaders, remote access tools and malware that can download further threats later. Malwarebytes reported ClickFix campaigns delivering malware families including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport and a Rust-based stealer.
For small businesses, schools, care providers and charities, this matters because one infected device can become the start of a much bigger problem.
An information stealer may grab browser passwords, session cookies or saved login details.
A remote access tool may let an attacker control the device.
A loader may bring in something worse later.
A stolen session could lead to Microsoft 365 access, supplier fraud, invoice fraud or data theft.
The first click is rarely the end of the story.
ClickFix is not always the final attack.
It is often the doorway.
Why this is different from old phishing advice
Old phishing advice often focused on links and attachments.
Do not open the attachment.
Do not click the link.
Check the sender.
Those things still matter, but ClickFix changes the conversation.
The person may not be asked to enter a password.
The file may not look like a traditional attachment.
The command may be pasted into a trusted Windows tool.
The page may look like it is helping.
That is why staff training needs to move beyond “spot the bad email”.
People need to know that websites should not be asking them to run commands on their computer.
That is the red flag.
A real verification page should not ask you to paste a command into Windows.
A real CAPTCHA does not need PowerShell.
A real Cloudflare check does not need you to open the Windows Run box.
The line I would teach staff
If a website asks you to press Windows + R, open PowerShell, open Command Prompt, open Terminal, or paste a command to fix a problem, stop.
Close the page.
Do not follow the steps.
Ask IT or your cyber support team.
That one simple rule can stop a lot of damage.
What businesses should do
1. Update awareness training
Add ClickFix to your cyber awareness training.
Keep it simple.
Show people what the attack looks like. Explain that the danger is not just the link. It is the instruction to run something.
This should not be a once-a-year tick-box exercise. Small, regular reminders work better because the scams change quickly.
A good staff message would be:
“A website should never ask you to open PowerShell, Terminal or the Windows Run box to prove you are human. If you see that, stop and report it.”
2. Watch for suspicious script activity
Your security tools should be watching for unusual use of PowerShell, Windows Script Host, command prompts, encoded commands, suspicious downloads and activity launched from browsers.
This is where Managed EDR or MDR helps.
A person might make one mistake.
Your monitoring should give you another chance to catch it.
3. Tighten browser and endpoint controls
Attackers often rely on trusted tools that are already present on Windows.
That does not mean you can block everything, but you can reduce risk with sensible controls:
Restrict unnecessary script execution.
Limit local admin rights.
Keep devices patched.
Use application control where it fits.
Monitor unusual child processes from browsers.
Block known malicious domains.
Use DNS filtering and web protection.
Use browser protection where appropriate.
Some browser protection tools can also warn when a website tries to copy content to the clipboard, which is a common ClickFix trick. That does not replace awareness training, but it can add another useful layer.
4. Protect Microsoft 365 properly
If ClickFix leads to stolen credentials, session theft or malware on a device, Microsoft 365 can quickly become part of the problem.
That means MFA still matters, but it is not the full answer.
You also want conditional access, risky sign-in reviews, audit logging, email security, backup and visibility of OAuth apps and sessions.
This is where ClickFix and ConsentFix overlap.
One abuses the person’s willingness to fix a problem.
The other abuses trusted consent flows.
Both remind us that identity security now sits right in the middle of cyber security.
5. Have a clear reporting route
People are more likely to report something if they know they will not be blamed.
Make it easy.
“If a page asks you to run a command, send it to us.”
That is much better than someone quietly hoping they have not done anything wrong.
No blame.
No drama.
Just stop and ask.
What to say to staff
A real website should not ask you to open the Windows Run box, PowerShell, Command Prompt or Terminal to prove you are human.
A real CAPTCHA does not need you to paste a command into your computer.
A real Cloudflare verification page does not need you to run a script.
A real Google Meet audio issue should not need a copied command from a random web page.
If you see those steps, close the page and report it.
No blame.
No drama.
Just stop and ask.
ClickFix works because it turns helpful people into the delivery mechanism.
That is why cyber security cannot just be about blocking bad files.
It has to be about helping good people pause at the right moment.
If the fix asks you to run a command, the fix might be the attack.
Where Huntress Attack Disruption helps
ClickFix moves quickly because the attacker is not waiting for malware to sneak past a scanner. They are persuading the user to run the command for them.
That is why monitoring for suspicious behaviour matters.
Huntress has built an Attack Disruption Engine into its Managed EDR. It runs locally on the device and can interrupt certain attacker techniques in real time, including stopping malicious processes, blocking suspicious code execution and buying the SOC more time to investigate.
Huntress originally demonstrated this against fast-moving ransomware attacks, including Akira, where the engine repeatedly killed the ransomware process before files could be encrypted. Huntress has also been extending this approach to ClickFix-style attacks, where users are tricked into running suspicious commands themselves.
Training helps people stop and think. Managed EDR gives you another chance if someone makes a mistake.
The goal is not just to spot the attack, it’s to interrupt it before it becomes data theft, malware installation or ransomware.
For small businesses, schools, care providers and charities, that extra layer can make a big difference. If a user pastes a malicious PowerShell command into the Run box, you do not want to wait for someone to check a dashboard later. You want the behaviour spotted, disrupted and investigated quickly.
Learn more about Huntress Managed EDR and Attack Disruption.
Need help protecting your business?
Black Swan Cyber Security Solutions helps small businesses, schools, care providers and local organisations reduce cyber risk without the fear, fluff or enterprise price tag.
We can help with security awareness training, Managed EDR, Microsoft 365 security, email protection, DNS filtering, backup and practical cyber reviews.
Book a free cyber review and we will help you see where the gaps are.
