What Is the ClickFix Attack?
Cybercriminals are constantly finding new ways to bypass traditional security tools. One of the fastest-growing social engineering techniques is the ClickFix attack—a deceptive campaign that tricks users into infecting their own computers.
Unlike traditional phishing attacks that rely on malicious downloads or software vulnerabilities, ClickFix convinces users to manually execute a command on their own device. The result is often the installation of information-stealing malware, remote access trojans (RATs), ransomware, or other malicious software—all without the victim realizing what happened.
Because the user performs the action themselves, many antivirus and endpoint detection systems see the activity as legitimate, making ClickFix particularly effective.
How Does the ClickFix Attack Work?
A ClickFix attack usually begins when a user lands on a compromised or malicious webpage through:
- A phishing email
- A malicious advertisement
- A fake software update
- A search engine result
- A compromised legitimate website
Instead of immediately downloading malware, the page displays what appears to be a legitimate verification message.
Common examples include:
- “Verify you’re human.”
- “Complete this CAPTCHA.”
- “Your browser needs to update.”
- “Cloudflare security verification.”
- “Google Meet connection issue.”
- “Your session has expired.”
The page then instructs the user to perform several seemingly harmless steps.
For Windows users, the instructions often look like this:
- Press Windows + R
- Paste a command into the Run dialog (often already copied to the clipboard)
- Press Enter
For macOS users, victims may instead be instructed to:
- Open Terminal
- Paste a provided command
- Press Return
Once executed, the command silently downloads and launches malware directly into memory.
Why ClickFix Is So Effective
Traditional malware attacks depend on users downloading suspicious files or exploiting software vulnerabilities.
ClickFix is different.
Instead of attacking software, it attacks human trust.
The fake verification screens often imitate well-known companies such as:
- Cloudflare
- Microsoft
- Browser update notifications
Because many people encounter legitimate CAPTCHA challenges every day, the instructions feel routine and trustworthy.
This makes ClickFix a classic example of social engineering—manipulating users into bypassing their own security.
What Happens After the Command Runs?
Depending on the campaign, ClickFix may install a variety of malware families.
Security researchers have observed attackers delivering:
- Remote Access Trojans (RATs)
- Information stealers
- Credential stealers
- Clipboard hijackers
- Banking malware
- Ransomware loaders
- Persistence tools for long-term access
Many campaigns have distributed malware such as:
- Lumma Stealer
- DarkGate
- NetSupport RAT
- AsyncRAT
- SectopRAT
- XWorm
Once installed, attackers may steal:
- Passwords
- Browser cookies
- Saved credentials
- Multi-factor authentication session tokens
- Cryptocurrency wallet data
- VPN credentials
- SSH keys
- Corporate documents
- Remote access credentials
In business environments, this can quickly escalate into a full network compromise.
Why Antivirus Doesn't Always Stop ClickFix
One reason ClickFix has gained popularity is because it relies heavily on living-off-the-land (LOLBins) techniques.
Rather than downloading obvious malware executables, attackers leverage legitimate Windows utilities such as:
- PowerShell
- Windows Script Host
- MSHTA
- Rundll32
- CMD
Because these are trusted Windows components, security software often sees the activity as normal administrative behavior.
The malware payload is frequently downloaded only after the trusted process has already been launched by the user.
Warning Signs of a ClickFix Attack
Be suspicious if a webpage asks you to:
- Press Windows + R
- Open Terminal
- Paste a command into Run or Terminal
- Use PowerShell to “verify” yourself
- Copy and paste anything from your clipboard
- Install a browser update outside your browser’s official update process
- Complete unusual CAPTCHA instructions unrelated to clicking images or checkboxes
No legitimate website—including Cloudflare, Microsoft, Google, or CAPTCHA providers—will ask you to paste commands into your computer to verify that you’re human.
How to Protect Your Business
Organizations can significantly reduce their risk by combining technology with employee education.
Recommended best practices include:
Security Awareness Training
Teach employees that legitimate CAPTCHA challenges never require opening Run, PowerShell, Command Prompt, or Terminal.
Endpoint Detection and Response (EDR)
Deploy modern EDR solutions capable of detecting suspicious PowerShell and LOLBin activity.
Restrict Script Execution
Use Group Policy or endpoint management tools to limit unnecessary PowerShell and scripting capabilities.
Multi-Factor Authentication
MFA reduces risk if credentials are stolen, although attackers may still attempt to steal active session tokens.
Web Filtering
Block known malicious domains before employees can access fake verification pages.
Keep Systems Updated
Maintain current operating systems, browsers, and endpoint protection software to reduce the impact of secondary attack techniques.
What Should You Do If You Fall for a ClickFix Attack?
If you accidentally paste and execute one of these commands:
- Disconnect the device from the network immediately.
- Notify your IT department or managed service provider.
- Do not continue using the computer.
- Change passwords from a separate, trusted device.
- Run a full endpoint investigation before reconnecting the device.
- Monitor accounts for unusual activity.
The sooner incident response begins, the greater the chance of preventing attackers from moving deeper into your network.
Final Thoughts
The ClickFix attack demonstrates that cybercriminals no longer need sophisticated software exploits to compromise organizations—they simply need to convince someone to follow instructions.
By impersonating familiar services like Cloudflare and browser security checks, attackers exploit trust rather than technical vulnerabilities. As these campaigns continue to evolve, organizations should prioritize user awareness, endpoint protection, and proactive security monitoring.
Remember: If a website asks you to open Run, PowerShell, Command Prompt, or Terminal to “verify” you’re human, it’s almost certainly a scam.
Protect Your Business Before the Next Attack
Cyber threats like ClickFix rely on human interaction—not software vulnerabilities—which means employee training and layered security are more important than ever. GreenBean IT helps businesses reduce cyber risk through security awareness training, endpoint protection, Microsoft 365 security, and proactive monitoring. Contact us to learn how we can help protect your organization.
FAQ
ClickFix is a social engineering technique where attackers use fake CAPTCHA or verification pages to convince users to paste malicious commands into Windows Run, PowerShell, Command Prompt, or macOS Terminal. Executing the command installs malware without requiring a traditional software exploit.
Legitimate CAPTCHA services only ask you to complete visual or checkbox challenges. If a webpage instructs you to open Windows Run, PowerShell, Command Prompt, or Terminal and paste a command, it is almost certainly malicious.
ClickFix campaigns have been observed distributing information stealers, remote access trojans (RATs), credential stealers, ransomware loaders, and other malware families capable of stealing passwords, browser cookies, cryptocurrency wallets, VPN credentials, and sensitive business data.
Sometimes, but not always. Because ClickFix relies on legitimate Windows tools and user interaction, it may generate fewer traditional malware indicators. Modern Endpoint Detection and Response (EDR) solutions combined with user awareness training provide stronger protection.
Disconnect the affected device from the network immediately, contact your IT team or managed service provider, avoid using the device until it has been investigated, and change important passwords from a separate trusted device.
About GreenBean IT
GreenBean IT provides managed IT and cybersecurity services for businesses that rely on stable, secure technology to support daily operations. We work with organizations to improve reliability, reduce recurring technology issues, and create long-term IT strategies that support growth and operational continuity.
With experience across cloud platforms, cybersecurity, infrastructure management, and modern workplace technology, GreenBean IT helps businesses strengthen security and maintain more dependable IT environments. GreenBean IT is SOC 2 Type II certified, reflecting our commitment to maintaining strong security practices and data protection standards.