← All terms

ClickFix

ClickFix is a social engineering attack that uses fake CAPTCHAs or error prompts to trick victims into pasting and running malicious commands themselves.

ClickFix is a social engineering technique in which a web page — most often a fake CAPTCHA, a fake error message, or a bogus "fix it" prompt — silently copies a malicious command to the victim's clipboard and then instructs them to paste and execute it. Because the victim runs the command themselves, no malicious file passes through the browser or email gateway, and the attack sidesteps the controls built to catch downloads and attachments.

How it works

The victim reaches the lure page through a compromised website, malvertising, SEO poisoning, or a phishing email. The page displays a familiar checkpoint — "Verify you are human" — and clicking it triggers JavaScript that loads the clipboard with an obfuscated command. The page then presents "verification steps": press Win+R, press Ctrl+V, press Enter. Those three keystrokes open the Windows Run dialog, paste the attacker's command, and execute it — typically launching PowerShell or mshta.exe to fetch an infostealer or remote access trojan.

The technique is cross-platform: macOS variants direct victims to paste into Terminal, and the FileFix variant abuses the Windows File Explorer address bar instead of the Run dialog. ESET's telemetry recorded ClickFix growing more than 500% in the first half of 2025, making it the second most common attack vector after phishing.

How to defend against it

  • Teach one absolute rule. No legitimate website, CAPTCHA, or error message will ever ask a user to press Win+R, open a terminal, and paste a command. Ever. Absolute rules survive stress better than judgment calls.
  • Restrict the paste targets. Disable the Run dialog via Group Policy where it is not needed, enforce PowerShell execution policies, and enable script block logging.
  • Simulate the behavior. Include fake-CAPTCHA pages in your phishing simulation program so employees meet the lure safely first — copy-paste compliance is a distinct behavior from link-clicking and should be measured as one.
  • Hunt the pattern. A browser process spawning PowerShell or mshta.exe moments after clipboard interaction is a high-confidence indicator.
Full guide
Read the deep dive on this attack →

Related terms

MalvertisingMalvertising is the use of online advertising to spread malware or lead users to phishing pages, often through legitimate ad networks and search ads.SEO PoisoningSEO poisoning manipulates search rankings so malicious sites appear as top results, luring users to fake downloads, login pages, and support numbers.PhishingPhishing is a social engineering attack that uses fraudulent emails, websites, or messages to trick people into revealing sensitive information or installing malware.
See your Human Risk Score

NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.

Book a demo