By 
Cybercriminals are increasingly turning human behaviour into a weapon, using a deceptive social engineering technique known as “ClickFix” or “Pastejacking” to trick users into executing malicious commands on their own devices.
RELATED: NITDA issues urgent alert over ‘DeepLoad’ AI malware targeting Nigeria’s banks, government, and businesses
According to a CIL Security Advisory, ClickFix has rapidly emerged as a significant initial-access technique, reportedly accounting for 47 per cent of recorded initial-access attacks in recent observations.
ALSO READ: Kaspersky uncovers new SparkCat malware variant evading App Store and Google Play defences
Unlike conventional malware attacks that depend on victims downloading and opening malicious files, ClickFix manipulates users into voluntarily executing commands through legitimate operating-system utilities.
That makes the technique particularly dangerous because the victim effectively becomes part of the attack chain, potentially allowing malicious activity to bypass conventional security controls such as browser sandboxes, email filters and traditional antivirus defences.
What Is a ClickFix Attack?
ClickFix is a social engineering technique in which attackers create convincing fake prompts that persuade users to perform seemingly harmless troubleshooting or verification steps.
The fake prompts may appear as:
- CAPTCHA or “I am not a robot” verification screens
- Fake browser error messages
- Microsoft Office or plug-in installation alerts
- Fake Windows Update notifications
- Bogus technical support warnings
- Fake Blue Screen of Death (BSOD) messages
The common objective is to convince the victim to copy and execute a command supplied by the attacker.
The attack has also been observed targeting users across platforms, including Microsoft Windows and Android environments, with attackers relying heavily on deception rather than exploiting a conventional software vulnerability.
How the ClickFix Attack Works
The attack typically unfolds through a carefully engineered sequence.
1. The Bait: A Convincing Fake Warning
The victim first arrives at a compromised or malicious website.
This may happen through a phishing email, malicious advertisement, search-engine manipulation or a compromised legitimate website.
Once on the page, the victim encounters an urgent-looking notification claiming that something needs to be fixed immediately.
A fake CAPTCHA might instruct the user to complete a verification process, while another version may claim that the browser, Microsoft Office or Windows installation has encountered an error.
The objective is to create enough urgency and credibility to make the victim follow instructions without questioning them.
2. The Clipboard Hijack
The next stage involves pastejacking.
When the victim clicks a button such as “Verify”, “Fix It” or “Continue”, malicious JavaScript can manipulate the computer’s clipboard and place an attacker-controlled command into it.
The user may not realise that the clipboard contents have been replaced.
At this point, the attacker has effectively prepared the malicious payload without requiring the victim to download a conventional executable file.
3. The Victim Executes the Command
The fake website then instructs the user to open a trusted operating-system utility and paste the command.
On Windows, victims may be instructed to press Win + R to open the Run dialog, paste the command using Ctrl + V, and press Enter.
Because the user is manually initiating the action, the activity can appear to the operating system as legitimate user behaviour.
This is one of the characteristics that makes ClickFix particularly effective.
4. Malware Is Downloaded
Once executed, the malicious command can contact infrastructure controlled by the attacker and download additional malware.
Depending on the campaign, the payload could include information stealers, Remote Access Trojans (RATs) or other malicious software.
Threat actors may use malware families such as Lumma, Vidar and Rhadamanthys to steal information and establish control over compromised systems.
The Fake CAPTCHA Trap
One of the most effective versions of ClickFix relies on fake CAPTCHA verification.
The victim sees what appears to be a standard “I am not a robot” prompt.
Instead of simply clicking a checkbox, however, the fake verification process instructs the user to perform additional actions involving the Windows Run dialogue or command-line tools.
Because CAPTCHA challenges are familiar to internet users, the request can initially appear credible.
The danger begins when the user follows the instructions and executes a command supplied by the malicious webpage.
How ClickFix Can Lead to a Full System Compromise
The consequences can extend far beyond the initial infection.
Persistent Remote Access
A successful attack can install a Remote Access Trojan, giving threat actors the ability to remotely interact with the compromised machine.
Depending on the malware and privileges available, attackers may maintain access for an extended period.
Credential and Data Theft
Once inside a system, attackers may attempt to harvest:
- Passwords stored in browsers
- Authentication cookies
- Keyboard input
- Email credentials
- Corporate documents
- Sensitive business information
- Other authentication tokens
The stolen information can subsequently be used for account takeover, fraud, espionage or further attacks.
Ransomware and Lateral Movement
A compromised endpoint can also become an entry point into a wider corporate network.
Attackers may use stolen credentials or remote access capabilities to move laterally across connected systems, compromise additional devices and potentially deploy ransomware.
In a corporate environment, therefore, a single employee falling for a fake CAPTCHA could potentially become the starting point for a much larger security incident.
Why ClickFix Is Difficult to Detect
Traditional security models often focus on identifying malicious files, suspicious downloads or known malware signatures.
ClickFix changes that equation.
The attacker can use a legitimate system utility while relying on the victim to initiate the execution.
From the operating system’s perspective, the command may appear to have been launched by an authenticated user using a legitimate application.
The critical security event is therefore not simply the presence of malicious software, but the sequence of human actions and process executions that leads to the compromise.
This makes behavioural monitoring, endpoint detection and employee awareness increasingly important components of organisational cybersecurity.
How Organisations Can Protect Against ClickFix
Train Employees to Recognise the Red Flags
The simplest defence is also one of the most important: user education.
Employees should understand that legitimate websites, CAPTCHA services and software-update mechanisms should not require users to open Windows Run, launch PowerShell or Command Prompt, or paste commands into a terminal to verify their identity.
Any webpage making such a request should be treated as suspicious.
Implement Least Privilege and Attack Surface Reduction
Organisations should minimise the ability of standard user accounts and browsers to launch potentially dangerous administrative utilities.
Security teams should enforce User Account Control (UAC) and appropriate Attack Surface Reduction (ASR) policies to restrict suspicious execution chains involving tools such as PowerShell, Command Prompt and mshta.exe.
Deploy Endpoint Detection and Response
Endpoint Detection and Response (EDR) technologies can help security teams identify unusual process behaviour and investigate suspicious execution chains.
Security controls should be configured to detect anomalous relationships between browsers, the Windows Run utility, command interpreters and downloaded files.
Strengthen Web and DNS Filtering
Organisations should also use DNS and web filtering to prevent employees from reaching known malicious domains, suspicious script locations and unverified file-hosting services.
Blocking malicious infrastructure before a user reaches it can disrupt the attack chain before social engineering succeeds.
The Human Being Is Becoming the New Attack Surface
The rise of ClickFix highlights a broader evolution in cybercrime.
Attackers do not always need to defeat sophisticated security software directly. Increasingly, they can attempt to persuade users to bypass those protections themselves.
The technique exploits something technology cannot easily patch: human trust.
A convincing warning, familiar CAPTCHA interface or seemingly routine troubleshooting instruction can be enough to turn an ordinary internet user into an unwitting participant in a cyberattack.
For organisations, the lesson is clear. Cybersecurity cannot rely solely on firewalls, antivirus software and automated detection.
As ClickFix demonstrates, people, processes and technology must be protected together.
The most important rule for users is simple: if a website asks you to open Run, PowerShell or a command prompt and paste a command to fix an error or prove you are human, stop. Do not execute it.
