ClickFix demo
Educational Demo - ClickFix Attack
This is a safe demonstration showing how ClickFix attacks deceive users. No actual malware is present.
What is ClickFix?
ClickFix is a social engineering attack that has surged 517% in 2025, becoming the second most common attack vector after phishing.
The attack tricks users into:
- Believing they need to "fix" a technical problem
- Copying malicious PowerShell commands
- Running those commands themselves
- Unknowingly installing malware on their own systems
🛡️ How to Protect Yourself
- Never paste commands you don't understand into Run, Terminal, or PowerShell
- Be suspicious of any website asking you to run commands to "verify" or "fix" something
- Real CAPTCHAs never ask you to run commands on your computer
- Contact IT if you see suspicious prompts or errors instead of following instructions
- Keep software updated and use reputable antivirus/antimalware solutions
- Enable security features like Windows Defender SmartScreen and browser security warnings
🚩 Red Flags to Watch For
"Verify now or lose access", countdown timers, threats of account closure
Asking you to open Run dialog, Terminal, or PowerShell and paste commands
Misspelled domains, unusual TLDs, or URLs that don't match the claimed company
Commands with "-w hidden", "-WindowStyle Hidden", or obfuscated code
This bypasses traditional security because the victim executes the malicious code themselves!
Real-World Impact
Security Verification Required
Please verify you are human to continue
To verify:
- Press Windows + R
- The verification code has been copied - just paste and press Enter
⚠️ The malicious code is now in your clipboard!
In a real attack, you would now press Win+R, then Ctrl+V, then Enter - and your system would be compromised.
⚠️ Command Copied!
The malicious command has been copied to your clipboard.
Now Try This (Safe Demo):
Follow these steps to see what the victim would experience:
- 1 Press Windows + R on your keyboard to open the Run dialog
- 2 Press Ctrl + V to paste the command
- 3 Press Enter to execute
✓ Don't worry - this is completely safe!
The command will simply open a new browser tab with educational content. This demonstrates how easy it is to execute commands, but contains NO malware.
What the copied command looks like:
In a real attack, this would download and execute malware instead of opening a webpage.
❌ What Just Happened?
You were tricked into copying malicious code that you would then execute yourself!
The Attack Chain
- 1
Deceptive Lure
Fake CAPTCHA, error message, or security warning appears on compromised or malicious websites - 2
Social Engineering
Instructions seem legitimate ("verify you're human", "fix error", "update security") - 3
Auto-Copy Code
Malicious PowerShell commands are automatically copied to victim's clipboard - 4
User Executes Code
Victim opens Run dialog (Win+R), pastes code, and presses Enter - 5
Malware Installation
Hidden PowerShell downloads and executes malware: ransomware, infostealers, RATs, or backdoors
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!