ClickFix gets your users to install the malware themselves

Imagine one of your users pulls up a supplier’s website—one they visit every week. This time, a Cloudflare-style box sits over the content, asking them to verify they’re human before they go any further. The typical verification process is usually just a checkbox, but this one lays out a few steps: hold the Windows key and press R, paste with Ctrl + V, and hit Enter. Unbeknownst to the user, the page has already written a malicious command to their clipboard. Those three keystrokes run it.

This social engineering technique is called ClickFix , and it’s been spreading since researchers first identified it in 2023. When ReversingLabs ran its own structural detection rule across more than 4,000 ClickFix samples, 123 lures evaded every antivirus engine Opens a new window . The same report prices complete attack kits on underground forums at $250 a month and $1,800 for a lifetime license. These attack kits are cheap, easily accessible, and may soon target a device you manage.

Your awareness program probably wasn’t built for this slippery threat. Most phishing training Opens a new window teaches people to squint at senders, hover over links, and distrust attachments. Every one of those lessons assumes the threat arrives in the inbox. A ClickFix lure may have nothing to do with the inbox, though. Your users can run into it on a legitimate website they visit all the time, assuming it’s the same kind of routine check they click through every day. If cybersecurity falls on your shoulders, it’s important for you to understand how to adapt your training to prevent these kinds of attacks.

Why antivirus and EDR miss ClickFix attacks

The whole ClickFix chain runs on software your environment already trusts. A bit of ordinary JavaScript on the lure page loads the command onto the clipboard, the victim supplies the keystrokes, and the payload typically runs in memory through PowerShell or another signed Windows utility. Nothing that looks like traditional malware ever touches the disk. Security researchers call the technique “living off the land,” and ClickFix relies on it from end to end. Sellers of ready-made ClickFix kits even advertise this built-in evasion as a feature (which makes sense if you’re wearing a black hat and not a white one).

Behavioral detection struggles here too, sadly. If one of your users launches PowerShell and fetches a script, your endpoint detection and response (EDR) sees routine admin work. To the console, it looks like a Tuesday. The lure takes advantage of trust and timing rather than a software flaw, so the user ends up doing the attacker’s typing for them.

Cheap kits and hijacked websites fuel ClickFix’s spread

Microsoft’s 2026 Digital Defense Report counts ClickFix-style pasted commands running on more than 1.1 million unique devices Opens a new window between February and early May of this year, roughly an eightfold jump. That’s a lot of trust silently being turned against people in a few months. Microsoft’s Defender Experts now trace 13% of the initial-access intrusions they investigate to malicious copy-and-paste attacks, and malware followed in 96.3% of them.

Phishing links play a part, but they’re just one path among several. CTM360 tracked more than 3,000 compromised legitimate websites Opens a new window serving fake Cloudflare verification pages. The cyber threat intelligence company calls hijacked sites the largest delivery channel, ahead of malvertising and poisoned results.

Rapid7’s incident responders listed ClickFix among the top malware they observed Opens a new window in manufacturing and business-services investigations last year. Unfortunately, the targets include small and medium businesses like yours, not only large enterprises. Since the lure your users meet quarter probably won’t look like the ones circulating today, it’s important to keep on top of this developing threat.

The lures are evolving faster than security training can keep up

The operators are iterating quickly, looking for even more effective variations on ClickFix in an attempt to keep evading detection. The original lures sent people to the Run dialog, which leaves a record investigators can check. Newer campaigns route through Windows Terminal, which doesn’t. A variant known as FileFix moves the paste into the File Explorer address bar to slip past monitoring aimed at PowerShell.

CrashFix crashes the browser first, so the victim has a genuine problem to fix when the recovery instructions appear. Mac users get parallel lures, often styled as disk-cleanup support articles. When Apple added a warning for commands pasted into Terminal, operators shifted to the macOS Script Editor. The artwork turns over constantly because it’s cheap to swap. The steps underneath it don’t.

CrowdStrike’s latest global threat report indicates that cybercriminals are using generative AI to keep the lures fresh and localized, too. Its researchers describe an adversary they track as Renaissance Spider, which used AI to rewrite its lures in Ukrainian Opens a new window , making the bait more convincing to victims in that country.

Meanwhile, most training programs date back to when the threat arrived by email. The lessons lead with senders, links, and attachments. If yours still does, your users may not have any reason to see a verification page as a threat. After all, ironically, the verification page is challenging them to prove they’re human—ostensibly for security purposes. If you haven’t refreshed your training lately, now is the time to rethink phishing training from the ground up.

Update your awareness training with one rule

So what do you tell your users to look out for now? You can hand them one rule that survives every redesign of the lure. If a website, error message, meeting app, or update prompt tells them to paste a command, they’re looking at the attack itself. That’s true whether the destination is the Run box, a terminal window, or the File Explorer address bar. The right response is to close the tab and report what they saw.

There’s no screenshot gallery to memorize and no judgment call to make sender addresses. Legitimate software doesn’t deliver fixes by asking people to paste commands into their operating system. Developers need a corollary of their own, since they paste install commands into a terminal as part of a normal day, so teach them to judge a command by where it came from rather than by what it looks like.

The rule works best when your users can flag a page without a second thought. A user who closes the tab and raises a hand hasn’t been harmed, and they’ve handed you an early warning a compromised site your people visit. That calls for a no-shame reporting culture where the person who nearly pasted gets a thank-you rather than a lecture. The user who did paste needs to feel comfortable coming forward even faster. Stolen credentials and session cookies start moving within minutes, so you’ll probably want to treat that report as an incident.

You can back up your training with some targeted interventions on the back end, too. Managed Chrome and Edge can block websites from writing to the clipboard, which keeps the command from reaching your users in the first place. Group Policy can pull the Run dialog from standard users’ Start menus (few will ever miss it). PowerShell script-block logging records what a pasted command did. And if you’re already watching a short list of high-value signals , a PowerShell process kicking off with a long, encoded command line might be worth including among them.

Teach your users to spot a fake CAPTCHA

Given that October is Cybersecurity Awareness Month, you have a ready-made excuse to swap a module or add a new one. Walk your users through a real fake-CAPTCHA screen, give them the paste rule in everyday language, and fold the lesson into your awareness program’s regular cycle . If you get that far, the verification page that pops up is far likelier to end as a closed tab and a help desk ticket. Then, instead of dealing with malware, you’ll get an early warning that ClickFix has arrived.