ClickFix attack: How fake CAPTCHA and “fix” prompts are delivering malware

ClickFix and its associated attacks have become one of the most popular methods that threat actors use to compromise individual users and enterprise environments. The draw for attackers lies in its simplicity –  websites can be spun up within minutes that effectively trick users into executing malicious commands on their device through social engineering tactics. By presenting fake errors, CAPTCHA failures, or “verification” steps, these pages instruct users to copy and paste commands into PowerShell or the Run dialog, effectively bypassing traditional security controls. 

Multiple variants now exist, ranging from fake browser fixes and document access prompts to enterprise-themed lures. The end goal is typically the delivery of infostealers, malware loaders, or remote access tools that provide attackers with persistent access. Defenders should be monitoring for unusual command line activity launched from user sessions, especially browser-initiated command execution. Most importantly, users should never copy and execute commands from a website, no matter how real or convincing it seems. 

Learn how threat detection can work in a SOCaaS model

ClickFix:

ClickFix operates by directing users to attacker-controlled or compromised websites that present convincing security-themed prompts. These typically appear as fake CAPTCHA checks, browser verification steps, or urgent security warnings that claim suspicious activity has been detected. The messaging is deliberately simple and authoritative, guiding the user through a short set of non-technical instructions designed to “resolve” the issue. 

Unlike traditional drive-by-downloads, ClickFix relies on user participation. Victims are instructed to copy and paste commands in the Run dialogue box, PowerShell, or browser console that ultimately execute malicious code. Because the action is user-initiated and often leverages legitimate system tools, the activity can appear benign – allowing the attacker to bypass traditional signature-based detections. 

Both of these methods follow the same steps; telling the user to open the ‘Run’ application with the Win + R shortcut, press Ctrl + V to paste in a command, and then press Enter to execute it. For non-technical users this can seem legitimate, however these malicious websites are injecting malicious commands into the user’s clipboard which the user then executes to download malware onto their device. Most commonly the type of malware downloaded is infostealer malware, designed to steal your passwords and any other sensitive information stored on your device. These basic steps are the backbone of ClickFix and its associated attacks, which come in various forms. 

GlitchFix:

Similar to ClickFix, this method provides another reason for the website to display a popup to the user. In some cases, the victims are specifically targeted, and when a user matching the target criteria visits, the website displays corrupted or illegible text, font replacement with symbols, fake Chrome updates, or missing system font errors. This makes the page seem broken and the popup presented to the user provides a ‘fix’. 

Figure 3: GlitchFix Attack

FileFix:

FileFix is another way attackers exploit human trust to deliver their malicious payloads. Instead of convincing a user to open the Windows Run dialogue, FileFix moves the attack to the more familiar and trusted environment of Windows File Explorer. Users are prompted to copy a file path, open File Explorer and perform a shortcut which will select the address bar.

From here the user copies the file path into the address bar and presses enter. Except the file path the user has copied is padded with spaces to hide the malicious PowerShell command – all the user sees are what they believe to be a legitimate file path. 

Figure 4: FileFix in Action

CrashFix:

CrashFix takes a different spin on the typical attack and provides a more compelling reason for the user to execute malicious commands. In one case a malicious browser extension posing as an adblocker was observed causing the users browser to become unresponsive once installed.

Figure 6: CrashFix Example

Once the browser restarts a popup appears prompting the user to run a scan. Once the scan has completed the user is presented with the following popup.

Figure 7: CrashFix Popup

We can see that although the delivery methods are different, all ClickFix family attacks end at the same point: the user is prompted to open the Windows Run dialogue, copy a command, and then run it.

Delivery methods:

As we’ve seen in these examples, ClickFix attacks can be packaged and delivered in multiple ways; malvertising, SEO-poisoned support pages, phishing emails, compromised websites, malicious browser extensions, collaboration platforms, and watering hole attacks. The common denominator between all of these is the social engineering step that convinces the user to execute attacker instructions.

Following the payload through:

An example of a malicious command the attackers want the victim to execute is shown below:

The captured script contains several malicious behaviours:

• Clipboard Execution: It retrieves the hidden payload from the clipboard (Get-Clipboard -Raw).
• Obfuscation: The command concatenates strings (“htt”+”ps”+”://”) to evade simple detection and static analysis.
• Process Manipulation: It hides the execution window using API calls (ShowWindow).
• Payload Retrieval: The script constructs a URL (www-account-booking[.]com/c.php?a=0) and issues a web request with a standard User-Agent string (Mozilla/5.0) to appear legitimate.
• Dynamic Execution: The downloaded content is read into memory and executed directly (Invoke-Expression), never touching disk, making detection more difficult.

This approach allows attackers to deliver additional payloads (such as MSI droppers) stealthily, bypassing traditional antivirus and relying on social engineering to trick users into running the command themselves.

Detecting ClickFix:

Detecting ClickFix and similar attacks means looking beyond the pop-up and into what happens next. Indicators lie in the execution chain after the user-initiated actions trigger suspicious system behaviour.

The below query correlates two queries to find cases where a user accessed RunMRU (The Windows Run dialogue accessed with Win + R) and then executed a suspicious PowerShell command. Evalian runs this query at 10-minute intervals, ensuring any activity that meets the detection criteria is surfaced to our analysts rapidly. This enables swift investigation, containment, and remediation, which significantly reduces dwell time and limits potential impact.

Defending Against ClickFix & Co

These attacks rely on the trust and naivety of users instead of the technical flaws in defensive systems. By leveraging urgency, fear, and trust, they bypass traditional, signature-based security controls and evade default antivirus and reactive SOC monitoring. By the time an alert is triggered, the user has often already executed the attacker’s instructions. Controls can be put in place for both users and endpoints to reduce the likelihood of compromise.

User awareness training should enable users to recognise suspicious websites and avoid following website instructions that reference Win+R, Ctrl+V, and Enter. Users should not blindly paste commands into PowerShell or browser consoles from websites. “Security warnings” displayed within webpages should be treated as untrusted unless they clearly originate from the browser UI or an approved endpoint security tool.

Endpoint controls can include constraining PowerShell through enhanced logging, script block logging, AMSI integration, and Constrained Language Mode where appropriate. Configurations can also be made to block or alert on suspicious Living-Off-The-Land Binary (LOLBIN) usage, implement clipboard-related behavioural detections, and Attack Surface Reduction (ASR) rules where feasible.

Evalian’s Security Operations Centre as a Service (SOCaaS) takes a proactive approach through proactive threat hunting, behavioural analytics, and custom detection engineering built around real-world attack patterns enabling us to identify and disrupt the techniques behind the ClickFix attack family.

Why this bypasses traditional controls

ClickFix and its related variants are effective because they don’t rely on exploiting software vulnerabilities but instead they rely on users to execute the attack themselves. Traditional controls are largely designed to detect malicious files, exploit behaviour, or known signatures – but in these campaigns those indicators don’t exist. The user is socially engineered into copying and executing commands directly on their endpoint, frequently using legitimate tools such as PowerShell and Command Prompt.

By the time a malicious script reaches out to download a second-stage payload, the activity is already running under a trusted user context. Basic antivirus, signature-based detections, and reactive monitoring are unable to differentiate this from legitimate command-line usage.

This is where continuous telemetry analysis, behavioural detection engineering, and rapid response capability become critical. Platforms such as Evalian’s SOCaaS are able to not just prevent malware, but also identify the misuse of legitimate tools before it turns into a full compromise.

Evalian can support your SOC

If you’re looking to stay ahead of threats like ClickFix, it’s worth going deeper into how modern attacks are actually detected and stopped in practice.

Our SOC resources break down real-world attack patterns, detection strategies, and response approaches used by our analysts every day. You can also explore how our SOC as a Service helps organisations identify and disrupt this kind of activity early, before it leads to a wider compromise.

Evalian’s SOC as a Service