ClickFix Lures Trick Users Into Pasting Commands

How the ClickFix Workflow Operates

ClickFix is built around a simple but effective trick: it gets the target to do the attacker's work. A fake webpage, styled as a CAPTCHA check, browser update notice, or meeting error, instructs a visitor to open Windows Run or macOS Terminal, paste a command, and press Enter. Before the victim even reads the instructions, JavaScript on the page has already copied a malicious command to the clipboard, so the user is simply pasting what the attacker prepared. Because the command runs through PowerShell, mshta, or curl, tools already trusted on the system, the method skips exploits and vulnerabilities entirely and relies purely on the person following instructions.

Why It Succeeds

ClickFix works because it hides behind familiar, low-friction moments: a CAPTCHA prompt, a browser update, or a meeting error. These are the kinds of interruptions people are used to clicking through without much thought. The clipboard preloading step removes even the small effort of copying text, making the process feel more like following a normal fix than executing an unknown command. Delivery is varied too, spanning compromised websites, malvertising on legitimate ad networks, SEO poisoning, and phishing that impersonates vendors or internal IT teams, which means the lure can reach victims through channels they already trust.

Signs of an Evolving Threat

The tactic is not static. A newer variant called CrashFix deliberately crashes the victim's browser, then offers a lure promising to restore it, pushing the user to comply under the pressure of a browser that has genuinely stopped working. Security teams should treat CrashFix as evidence of an active development cycle behind ClickFix infrastructure. On top of this, a Malware-as-a-Service market now sells ClickFix kits and templates, letting attackers with limited technical skill run high-volume campaigns, which helps explain the tactic's rapid growth.

What to Watch For

• A webpage instructing you to run a command in Run or Terminal to verify, update, or fix something.
• Unexpected clipboard behavior, where pasting inserts a long command you never copied.
• Messages claiming to be from IT or a vendor that route you to a page requesting command execution.
• A sudden browser crash followed by a convenient repair prompt.
• Lures increasingly mimicking Microsoft 365 prompts, VPN errors, and internal IT portals rather than only targeting everyday consumers.

Building Resistance

Because ClickFix bypasses technical exploits, the strongest defense remains the person at the keyboard. Training should reinforce that no legitimate verification, update, or fix ever requires pasting a command into Run or Terminal, and that any such request should be reported to IT or security rather than followed. Recognizing fake browser updates, CAPTCHA pages, and IT support prompts is the layer where a person still gets a say, and reinforcing that habit across all employees, not just technical staff, is central to reducing exposure to this tactic.

What is a ClickFix attack?

ClickFix is a social engineering tactic where a fake webpage, such as a CAPTCHA check, browser update notice, or meeting error, instructs a visitor to open Windows Run or macOS Terminal, paste a command, and press Enter. The command was already copied to the clipboard by JavaScript before the user saw any instructions.

How do attackers get victims to a ClickFix page?

Victims reach ClickFix lure pages through compromised websites, malvertising on legitimate ad networks, SEO poisoning, and phishing campaigns impersonating vendors or internal IT teams.

What is CrashFix?

CrashFix is a ClickFix variant identified by researchers at Huntress and Microsoft Defender Experts that deliberately crashes the victim's browser, then offers a fix that leads to running a malicious command.

How can employees defend against ClickFix?

Employees should be trained to never run commands from a webpage to verify, update, or fix something, and to report such prompts to IT or security instead, since the social engineering layer is where a person still has a chance to stop the attack.