What Is ClickFix (and FileFix)?

You click “I’m not a robot,” but instead of a green checkmark, an error message tells you to complete a quick manual verification step. Without your knowledge, JavaScript running on that page has already copied a hidden, malicious command directly to your computer’s clipboard. The prompt instructs you to open your Windows Run dialog, paste the text, and hit Enter to “fix” the issue.

This is the mechanism behind ClickFix, a dangerous social engineering technique that exploded across the threat landscape over the past two years. Alongside its newer, even stealthier variant known as FileFix, this vector has upended traditional defense models.

What makes a ClickFix attack so uniquely frustrating for security teams is the total absence of traditional indicators of compromise. There is no malicious file download to intercept, no software vulnerability being exploited, and no cracked passwords.

What Is ClickFix in Cybersecurity?

ClickFix is a fileless social engineering technique where a compromised or malicious webpage displays a deceptive error message, fake CAPTCHA, or verification prompt to a user.

Security researchers first documented this specific technique in 2024. It evolved from an earlier, cruder precursor known as “ClearFix” that was spotted tracking back to October 2023. The name “ClickFix” is not an official industry standard designation, but it quickly became the default term used across the cybersecurity industry as the threat surged in popularity throughout 2024 and 2025.

The psychological trick relies entirely on user habits. People are thoroughly conditioned to click through verification boxes and self-resolve minor browser errors to get to the content they actually want. ClickFix capitalizes on that exact reflex by offering an immediate solution to a manufactured technical roadblock.

Why Does ClickFix Bypass Traditional Security Tools?

Standard enterprise defenses are designed to hunt for malicious payloads entering the network perimeter. ClickFix effortlessly evades these architectures through several distinct operational advantages:

• Secure email gateways, static antivirus engines, and many Endpoint Detection and Response platforms have absolutely nothing to analyze, because no executable file is actually downloaded or attached during the initial compromise stage
• The hijacked clipboard command leverages trusted, pre-installed system utilities like PowerShell, the Windows Command Prompt, or the macOS Terminal to carry out its tasks. Because IT administrators use these exact tools every single day for legitimate operations.
• MFA is designed to secure identity access during a login session. A ClickFix attack targets the active endpoint session directly after authentication has already occurred, so even the most robust MFA policies cannot stop the execution.

How Does a ClickFix Attack Work Step by Step?

An active ClickFix campaign generally plays out across five distinct tactical phases:

Step 1: The Lure

The threat actor gains control of a legitimate website (frequently by compromising poorly secured WordPress sites or ad networks) or sets up a dedicated malicious domain. They often use typosquatting or malvertising to drive organic traffic to these locations. To maximize credibility, the pages heavily impersonate trusted corporate brands like Microsoft, Cloudflare, or Booking.com.

Step 2: The Fake Verification

When a user lands on the page, the attacker uses an overlay to block the expected content. The user is presented with a highly realistic fake CAPTCHA box, an artificial “browser update required” alert, or a document loading error featuring a prominent “Fix It” or “Verify” button.

Step 3: The Clipboard Hijack

The moment the victim clicks that button, a hidden background JavaScript snippet triggers. This script automatically overwrites the user’s system clipboard with a heavily obfuscated, malicious command string. This clipboard change happens silently, with no visible confirmation.

Step 4: The Instructions

The webpage immediately switches to an instruction screen. It guides the victim through a precise sequence of keyboard shortcuts: press Win + R to open the Windows Run box, press Ctrl + V to paste the copied content, and press Enter. The page frames this sequence as a necessary manual patch to resolve the loading error.

Step 5: Execution and Payload Delivery

Once the user presses Enter, the operating system executes the hidden clipboard command. This typically initiates a silent background connection to a remote server to download and install specialized malware. The browser itself never handles an explicit file download link, rendering browser-level web filters completely blind to the installation.

What Is FileFix and How Is the Attack Evolving?

As corporate security operations centers (SOCs) began monitoring and restricting the use of the Windows Run dialog, attackers quickly modified their approach. On June 23, 2025, security researcher mr.d0x publicly disclosed a stealthier alternative evolution dubbed FileFix.

Instead of forcing users into administrative command boxes, a FileFix attack displays a normal-looking “upload file” button on a webpage. Clicking this button triggers a legitimate, native Windows File Explorer window. The instruction page then directs the user to click into the File Explorer address bar at the top, paste the clipboard contents (disguised as a file path), and hit Enter.

This variant is significantly more dangerous for two reasons. First, everyday corporate employees find File Explorer far more familiar and less alarming than the technical-looking Run box. Second, File Explorer is deeply integrated into core desktop operations, making it difficult for IT teams to lock down via traditional Group Policy (GPO) controls, unlike administrative command utilities.

Timeline of Abuse: How Threat Actors Built Upon FileFix

Threat groups put this new research into action with alarming speed. Check Point Research spotted active threat actors testing FileFix code inside live phishing infrastructure by July 6, 2025, fewer than two weeks after the initial public disclosure. By mid-July 2025, the DFIR Report documented an active live campaign (tracked under the name “KongTuke”) utilizing FileFix to deliver an advanced variant of the Interlock Remote Access Trojan (RAT). By September 2025, researchers discovered modified FileFix variants incorporating steganography, hiding malicious payloads entirely inside harmless image files, hosted on multilingual phishing sites to quietly distribute StealC malware.

ClickFix Use Cases

ClickFix has transitioned from an experimental cybercrime trick into a preferred deployment tool for highly sophisticated threat groups. Within a tight 90-day window spanning October 2024 to January 2025, four major nation-state threat actors integrated ClickFix into their active cyberespionage operations: Russia’s APT28, North Korea’s Kimsuky, Iran’s MuddyWater, and the Russia-linked group COLDRIVER. Pakistan’s APT36 followed suit shortly after in May 2025. Rather than building entire operations from scratch, these advanced persistent threats (APTs) swapped ClickFix into their existing phishing frameworks.

Several notable campaigns highlight the sheer diversity of these operations:

• APT28’s Google Sheets Decoy: This group utilized a highly accurate fake Google Spreadsheet page to lure victims into a reCAPTCHA prompt. Clicking the box silently established an encrypted SSH tunnel and deployed Metasploit directly onto the target network, granting attackers permanent backdoor access.
• MuddyWater’s Patch Tuesday Campaign: Operating under the moniker TA450, this group coordinated massive phishing waves explicitly timed to match Microsoft’s monthly Patch Tuesday schedule. The emails impersonated urgent Windows security update alerts, successfully targeting at least 39 prominent organizations across the Middle East.
• Storm-1865 Hospitality Wave: This actor systematically impersonated automated Booking.com communications to target administrative hotel and travel industry staff, engaging in employee credential harvesting.
• Automotive Supply-Chain Breach: In March 2025, a single compromised third-party vendor named LES Automotive resulted in ClickFix infection scripts being injected across more than 100 different automotive dealership websites simultaneously.
• Ransomware Fallout: The Interlock ransomware group has also adopted ClickFix for initial access, including a documented August 2025 incident affecting a U.S. state or local government victim.

How Has ClickFix Malware Evolved?

The technical barrier to entry for this attack has cratered. Commercial “ClickFix builder” kits are now widely bought and sold on underground hacking forums, allowing low-skill cybercriminals to launch custom campaigns. Furthermore, the attack is no longer strictly limited to Windows systems; recent variants have expanded to target macOS users via base64-encoded Terminal commands, as well as Linux enterprise environments. Independent threat-intelligence teams, including Recorded Future and the Center for Internet Security, reported that ClickFix remained one of the most active initial-access techniques into 2026, with new lure themes (fake meeting invites and software update prompts among them) continuing to appear.

The variety of final payloads delivered via these methods includes a wide range of dangerous types of malware:

Among these payloads, Lumma Stealer remains the most dominant. Microsoft identified more than 394,000 infected Windows devices globally during a brief two-month window between March and May 2025. While a massive law enforcement operation involving Microsoft, Europol, the FBI, and the DOJ successfully executed a coordinated takedown of this infrastructure, portions of the Lumma backend managed to recover and resume operations within just a few weeks.

What Do ClickFix and FileFix Look Like by the Numbers?

The quantitative metrics surrounding these fileless campaigns demonstrate why they have become an industry-wide emergency:

• 517%: The massive surge in ClickFix detections recorded by ESET in the first half of 2025 compared to the final half of 2024. This explosive growth positioned it as the second most common initial attack vector worldwide, trailing only traditional phishing.
• 8%: The total proportion of all global web-based attacks blocked by telemetry that are driven explicitly by ClickFix scripts.
• 47%: The percentage of all initial-access notifications issued by Microsoft’s Defender Experts threat hunting team attributed directly to ClickFix vectors over a 12-month period.
• 54%: The percentage of ransomware victims who had their corporate domain credentials show up for sale on stealer-log marketplaces prior to the actual encryption event, according to Verizon’s 2025 Data Breach Investigations Report (DBIR).

This last metric highlights the dangerous credential-theft-to-ransomware pipeline. The median time gap between an employee losing their credentials to an infostealer and a threat group deploying ransomware across that corporate network is currently just two days. Because ClickFix and FileFix are among the primary delivery mechanisms fueling these credential marketplaces, stopping these initial interactions is a critical prerequisite to avoiding a catastrophic ransomware deployment.

How Can You Spot a ClickFix or FileFix Attempt?

Corporate employees are the frontline defense against this threat. To protect your endpoint, cross-reference any unusual web prompt against this safety checklist:

• A legitimate website will never ask you to open your Windows Run dialog, a Terminal, or your File Explorer address bar to “verify” your identity or clear a browser error.
• Be suspicious of any CAPTCHA or error warning that tells you to press key combinations like Win + R, Cmd + Space, or Ctrl + V.
• If you paste something and get a long string of code you never copied, your clipboard has been compromised. Don’t paste or run that content anywhere.
• Standard security tools run entirely inside your active browser tab. They will never require you to leave the web browser or interact with external desktop software.

If you ever encounter an unfamiliar or suspicious link while browsing or via a message, you can verify its status using a dedicated free link checker tool before interacting.

How Can IT Teams Defend Against ClickFix and FileFix?

Because these attacks manipulate legitimate system behaviors rather than deploying traditional exploits, defending against them requires a layered security model.

1. Restrict and Monitor High-Risk Interfaces

IT engineering teams should implement restrictive Group Policy (GPO) controls to block access to administrative command interfaces like the Run dialog (cmd.exe) and native PowerShell execution for standard, non-administrative users wherever operationally feasible. Where complete restrictions are not possible, monitoring infrastructure should be configured to flag anomalies inside RunMRU registry keys, log all rapid clipboard content changes, and enforce comprehensive PowerShell script-block logging.

2. Move Detection Architecture Beyond the File

Because traditional static file scanning fails against fileless malware, security operations must look at the complete behavior chain. Security stacks should combine advanced perimeter web filters to scan incoming HTML/URL structures with endpoint behavioral analytics capable of identifying the distinct signature of a browser process injecting commands into system tools.

3. Cut Off the Initial Phishing Delivery Vector

While the ClickFix interaction happens on the web, the initial link is heavily distributed through targeted phishing emails or malicious ads that spoof trusted enterprise brands or internal corporate domains. According to reports from the Center for Internet Security (CIS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), public sector organizations frequently receive phishing lures utilizing abused subdomains of trusted services (such as trycloudflare.com or r2.dev) to bypass standard email filters and redirect victims to fake CAPTCHA screens.

Enforcing domain authentication protocols like Domain-based Message Authentication, Reporting, and Conformance (DMARC) at a strict enforcement policy of p=reject significantly reduces threat actors’ ability to spoof your organization’s domain when sending these initial phishing lures. It is important to be highly precise here: DMARC is an identity verification and brand protection control, not a direct fix for endpoint execution. It cannot stop an employee from pasting code into a terminal once they are already on a malicious site, but it significantly undermines the attacker’s ability to deliver highly convincing domain-spoofed emails that start the attack chain in the first place.

4. Provide Context-Specific User Training

Generic corporate security training that merely instructs employees to “not click suspicious links” is completely ineffective against the specific visual patterns used by ClickFix. Organizations need to deploy short, targeted training exercises focused entirely on this operational loop. The educational takeaway should be clear and actionable: If any website asks you to paste text into a Windows Run box or a File Explorer address bar, stop immediately and report it to IT.

5. Normalize Reporting Over Self-Fixing

ClickFix actively exploits the natural human habit of wanting to resolve minor technical glitches independently without bothering the help desk. Security teams must deliberately counter this behavior by creating clear, friction-free reporting processes. Employees must know that reporting a strange verification prompt is the expected, safe action.

Final Words: Securing the Human Element

ClickFix and FileFix represent a highly tactical shift in modern cybercrime. These campaigns do not waste time searching for complex zero-day software vulnerabilities; instead, they target a much simpler vulnerability: the natural human reflex to quickly click through a minor technical interruption. This simple behavioral exploit has proven so effective that it is now actively deployed by both opportunistic cybercriminals and sophisticated nation-state intelligence networks alike.

Defeating this threat requires a balanced, layered defense. Organizations must combine proactive endpoint monitoring, specific employee behavioral training, and technical authentication controls to block the initial delivery channels.

By implementing strict domain authentication, you can completely block unauthorized emails sent from your corporate domains. Take control of your email perimeter and protect your enterprise brand. Use the PowerDMARC Domain Security Platform to analyze your email ecosystem and enforce an active defense against phishing delivery networks today.

Frequently Asked Questions

What is ClickFix in cybersecurity?

ClickFix is a fileless social engineering technique where compromised websites show fake CAPTCHAs or browser error messages. When a user clicks the prompt, background JavaScript copies a malicious command to their clipboard, and instructions guide the user to manually paste and execute it using trusted system tools like the Windows Run box.

What is the difference between ClickFix and FileFix?

ClickFix tricks victims into pasting malicious clipboard commands directly into administrative system utilities like the Windows Run dialog or macOS Terminal. FileFix is a more advanced variant that tricks users into opening a standard Windows File Explorer window and pasting the command directly into the address bar, an interface that is more familiar to users and harder for IT teams to restrict.

How does a ClickFix attack infect a computer without a malicious file?

The attack avoids file downloads entirely during the initial compromise stage. It utilizes native background JavaScript to hijack the user’s system clipboard. The victim then manually pastes and executes that hidden code using trusted, pre-installed administrative operating system utilities, a method known as “living off the land”.

Which threat actors use ClickFix and FileFix?

The technique is widely used across the threat landscape. It has been adopted by widespread cybercriminal infostealer groups (delivering payloads like Lumma Stealer) as well as highly sophisticated nation-state espionage groups from multiple countries, including Russia’s APT28 and COLDRIVER, North Korea’s Kimsuky, Iran’s MuddyWater, and Pakistan’s APT36.

Can antivirus or MFA stop a ClickFix attack?

Traditional static antivirus software often fails to detect ClickFix because there is no malicious file download to scan during the initial interaction. Multi-Factor Authentication (MFA) also cannot prevent an infection, because the attack targets the active endpoint device directly rather than attempting to hijack a web application login session.

How can I tell if a CAPTCHA or ‘fix it’ prompt is a ClickFix attack?

A genuine human verification tool like Google reCAPTCHA runs completely inside your active browser tab and never requires you to open external desktop software. Any prompt that instructs you to use keyboard shortcuts like Win + R, open your Run box, or paste text into your File Explorer address bar to resolve an error is a ClickFix attack.

• About
• Latest Posts

Milena Baghdasaryan

Content Specialist at PowerDMARC

Milena is a skilled writer and content creator with 7+ years of experience in crafting engaging content on IT, cybersecurity, virtual events, and more. She has a proven track record of delivering high-quality work for international magazines and is a graduate of prestigious institutions such as New York University Abu Dhabi, UWC China, and the College of Europe.

Latest posts by Milena Baghdasaryan (see all)

• What Is ClickFix (and FileFix)? - July 8, 2026
• How to Choose an Email Service Provider: A Security-First Evaluation Framework - July 1, 2026
• Latin American Email Security: State of DMARC & Email Authentication in LATAM 2026 - June 30, 2026