The internet can feel like a minefield—just one misstep, one careless click, and suddenly you’re handing over access to malware, stolen data, or worse. One of the more clever and dangerous tricks making the rounds lately is called ClickFix. It’s a social engineering method that looks innocuous, but packs a nasty punch.
What is ClickFix, Anyway?
ClickFix works by exploiting how people tend to respond when something looks “slightly broken” — maybe a dialog box, a CAPTCHA, a human verification prompt, anything that suggests the site or system isn’t working right. The malicious twist comes when users are persuaded to copy, paste, and run commands on their own devices—often in the Windows Run dialog, PowerShell, or Terminal. These commands may load malware, steal credentials, or let attackers move deeper into a network.
Because the user is part of the chain (they execute the command themselves), many standard defenses—automated scans, email filters—can be bypassed. Attackers also disguise their commands, hide code, and mimic legitimate brands to lower suspicion.
How These Attacks Start
ClickFix campaigns usually begin with one of the following vectors:
-
- Phishing emails: Someone gets an email that seems legitimate—an invoice, a statement, something urgent. There might be attachments, or links that lead to a landing page made to look very real.
- Malvertising: Ads with malicious links or redirects, often placed on websites with seemingly innocent content. Clicking a play button, for example, triggers a redirect.
- Compromised websites: A site you trust might have been hijacked or has vulnerabilities. Once you land there, the original page quickly switches to a malicious “verification” or “click to confirm you’re human” style prompt.
Once you follow the prompt (often as simple as verifying you are human), you might be told to copy a piece of code into your Run dialog or Terminal. The code is usually obfuscated, chains several commands, or uses benign sounding names. From there, malware is loaded—often infostealers (to steal data), loaders, rootkits, or remote access tools. Sometimes, scripts hide, disguise themselves, or only download pieces step by step to avoid detection.
Real-World Examples
One campaign in 2025 targeted organizations in many countries using a variant called Lampion. Users received phishing emails with ZIP files, which led to HTML attachments. These attachments redirected them to sites mimicking tax authority pages. The lure would tell the victim to run PowerShell commands that fetched further scripts, hid payloads, and eventually tried to establish persistent malware.
Another campaign impersonated the U.S. Social Security Administration, spoofing trusted emails and domains. Victims were told to “download statements,” then navigated through fake human verification prompts before being enticed to run malicious code.
There have also been efforts aimed at macOS users; the same social engineering formulas are used, but the commands differ (tailored for macOS).
Why ClickFix Is So Effective
-
- Uses human trust: When you see something that looks like an error, or feels like site maintenance, many people want to “fix” it. Attackers rely on that impulse.
- Obfuscation: They hide what’s really going on. Fake CAPTCHAs, fake logos, hidden iframes, double file extensions, use of otherwise legitimate tools.
- Stepping through stages: Instead of all-in-one payloads, they use multiple stages—initial commands, scripts, then final malware—making detection harder at each step.
- Support tools for attackers: There are prebuilt kits for ClickFix, sold like malware-as-a-service: landing page templates, command generation, and promises of bypassing security tools. So even less skilled attackers can exploit it.
What You Can Do to Protect Yourself
Here are steps organizations and individual users can take to reduce vulnerability to ClickFix-style attacks:
-
- Awareness & training
Teach people to pause before clicking. If you ever see instructions to copy/paste commands or use unusual tools to “fix” something, stop. Ask questions. Verify the source. - Browser & email hygiene
Use email filters that catch spoofed addresses, attachments, or phishing links. Prefer email tools that re‐inspect links when clicked—not just when delivered. Protect attachments. - Restrict risky tools
Limit who can use the Run dialog, PowerShell, Terminal, or other command‐line tools unless absolutely needed. Use policies or settings to disable features if they aren’t used daily. - Enable script / process monitoring
Configure systems to log when scripts are run, especially obfuscated or multi-line ones. Use endpoint detection and response (EDR) tools to catch unusual command execution behavior. - Network protection
Block known bad domains early. Use DNS filtering, blocking of suspicious URLs, certificate validation, and web filtering. If a domain used in the ClickFix chain is flagged internally, stop it. - Use trusted browsers and platforms
Browsers with built-in protection (warnings for shady websites) help. Also, keep all software up to date—browser, OS, etc.—so known vulnerabilities are patched.
- Awareness & training
Final Thoughts
ClickFix is a reminder that no matter how strong your defenses are, human behavior matters. Attackers are leaning more and more into social engineering—tricking people, not just systems. The best “patch” we have is awareness, combined with good policy and tooling.
So the next time you get a weird prompt—something about verifying you’re human, or “click here to fix”—take a moment. Think before you click(fix). Your system, your data, and your peace of mind may depend on that pause.
