A CTM360 report describes real-world “ClickFix” campaigns where attackers compromise legitimate websites and show fake error/verification messages that trick users into copying a command and pasting it into trusted system tools (Run box, PowerShell, Terminal). This approach avoids traditional malware indicators (no exploit, attachment, or obvious download) and can lead to credential theft/info-stealing malware such as Vidar Stealer.
ClickFix campaigns start with a webpage, often on a legitimate site that has been compromised, that presents a fabricated problem the visitor believes is theirs to fix. Common pretexts include a Cloudflare-style human verification check that will not complete, or a macOS support article warning that a Mac is running low on storage. Instead of a normal fix, the page quietly writes a command to the clipboard and asks the visitor to open a trusted system tool, the Run box, PowerShell, Terminal, or a command prompt, and paste and press Enter. Because there is no exploit, attachment, or obvious file download involved, this approach avoids many traditional malware indicators. In at least one analyzed infection chain, the sequence ended with Vidar Stealer running inside a signed Microsoft binary through DLL side-loading.
The technique works because it borrows credibility from tools and sites people already trust. The victim, not an attacker-controlled file, performs the final execution step, which sidesteps download and attachment scanning. Microsoft attributed 47% of Defender Experts initial-access cases in 2025 to ClickFix, indicating this has become a major initial-access method rather than a fringe technique. Infrastructure resilience adds to the problem: lure hostnames rotate through blockchain-based systems on Polygon smart contracts, meaning domain blocklists are published too slowly to keep up.
Security awareness efforts should treat any copy-paste-into-system-tool request as an attack, regardless of how trustworthy the surrounding site appears. Because the lure infrastructure can rotate faster than blocklists update, and because researchers and sandboxes may be shown a clean page while real visitors see the malicious instructions, organizations should not rely solely on domain blocking or the absence of a sandbox detonation as proof of safety. Training for all employees, IT helpdesk staff, and website administrators should reinforce a simple rule: if a page asks you to paste something into a system tool, the page itself is the attack.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a social engineering technique where a compromised or fake webpage shows a fabricated error, such as a Cloudflare verification failure or low disk space warning, and instructs the visitor to copy a command and paste it into a trusted system tool like the Run box, PowerShell, or Terminal.
Attackers use rapidly rotating lure hostnames, in some cases managed through blockchain-based infrastructure, so lure domains change faster than blocklists can be updated, making domain blocking an ineffective control on its own.
Not reliably. The lures can be tailored per visitor based on OS and version, showing a clean page to researchers and sandboxes while delivering the malicious instructions only to intended targets, so a clean sandbox result does not prove a site is safe.
One analyzed infection chain led to Vidar Stealer running inside a signed Microsoft binary via DLL side-loading, following the clipboard paste and execute steps.
You click a trusted site, see a Cloudflare-style check that never finishes… then it says, “To fix this, copy this code and run it.” That’s ClickFix. The page quietly copies a command, tells you to open Run or PowerShell, paste, hit Enter… and now Vidar Stealer is running inside a signed Microsoft app. They even use Apple-style support pages: 'A Mac that is running low on storage.' Then: 'Paste this into Terminal to clean it up.' Real sites, rotating hostnames, and only the real victim sees the lure. Here’s the rule: if any website tells you to copy and paste a command into Run, PowerShell, Terminal, or a command prompt, stop and report it to Security. Do not run it.
Researchers observed real-world infections where compromised WordPress sites showed a fake “Cloudflare Turnstile” verification and instructed visitors to press Win+R and run a PowerShell command. The attacker’s page guides victims step-by-step (and reports progress back to the operator) to execute…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
