ClickFix is a social-engineering technique in which a web page shows a fake error or human-verification prompt and instructs the user to paste an attacker-supplied command into the Windows Run dialog, PowerShell or a terminal. Because the user runs the command themselves, the technique bypasses email filtering, sandboxing and download controls. MITRE ATT&CK tracks the behaviour as T1204.004 (User Execution: Malicious Copy and Paste).

ClickFix: The Fake-CAPTCHA Technique That Makes Victims Infect Themselves

ClickFix is a social-engineering delivery technique that persuades a user to run an attacker-supplied command on their own machine. There is no software exploit: a web page shows a fake error or human-verification prompt and instructs the victim to copy a string and paste it into the Windows Run dialog or a terminal. Because the user launches the interpreter themselves, the chain sidesteps email filtering, browser sandboxing, download reputation and macro controls. ESET telemetry cited by Netlas reported ClickFix and HTML fake-CAPTCHA activity grew roughly 517% between the second half of 2024 and the first half of 2025, and MITRE formalised a dedicated ATT&CK sub-technique for the behaviour in March 2025.

Overview

ClickFix was first observed by Proofpoint in early March 2024, used by the initial-access broker tracked as TA571, and was adopted within weeks by the ClearFake compromised-website cluster. Through 2024 and 2025 it shifted from fake browser-update lures to fake CAPTCHA and verification pages, and became a mainstream way to get code running on a target without ever tripping a download prompt.

Why it works

The victim is the one who opens the interpreter and presses Enter. That single design choice moves the whole chain outside the controls most organisations rely on — attachment sandboxing, macro blocking, download reputation — because none of them see a malicious file arrive.

How the Technique Works

Lure delivery. The victim reaches a malicious or compromised page via malvertising, SEO poisoning, a compromised site, or an email link. T1566
Fake prompt. The page renders a fake CAPTCHA or Cloudflare Turnstile, a “verify you are human” step, or a document or browser error.
Instruction. The page tells the user to press Win+R (or open PowerShell or a terminal), then Ctrl+V, then Enter — framed as the fix or the verification step. T1204.004
Clipboard hijack. JavaScript silently writes the malicious command to the clipboard, so the user pastes attacker content rather than what they believe they copied.
User execution. The pasted one-liner chains to a downloader. A Lumma chain documented by Seqrite in February 2025 ran mshta.exe against a remote resource, which executed embedded VBScript, which spawned PowerShell to pull a .NET loader. T1059.001 T1218.005
Payload. The loader fetches and runs the final malware, often via hidden-window or encoded PowerShell. T1105

Variants

FileFix — the victim is directed to paste into the Windows File Explorer address bar instead of the Run dialog.
TerminalFix — the paste target is an administrative PowerShell or terminal window.
LightPerlGirl (SecurityWeek, June 2025) — a PowerShell and clipboard-hijack variant that delivered Lumma Stealer from a compromised travel site.
ClearFake — a related upstream cluster that injects the lure JavaScript into compromised sites; later variants hid payloads with steganography and blockchain-hosted scripts.

Who Uses It

ClickFix is a shared technique rather than a single actor. On the cybercrime side it spans the initial-access broker TA571, the ClearFake operators, and numerous infostealer affiliates. Reporting through 2024 and 2025 also attributes use to nation-state activity, including North Korea’s “Contagious Interview” operations — a named MITRE procedure example for T1204.004 — with additional, moderate-confidence secondary reporting of use by APT28, Kimsuky and MuddyWater.

Payloads observed

ClickFix and ClearFake chains have delivered DarkGate, Matanbuchus, NetSupport RAT and a range of infostealers, with Lumma Stealer among the most common. Treat sector-impact counts from secondary aggregators as indicative until confirmed against the original vendor reports.

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Execution	T1204.004 Malicious Copy and Paste	Canonical ClickFix mapping — user pastes and runs the command
Execution	T1059.001 PowerShell	Downloader and payload execution
Execution	T1059.005 Visual Basic	VBScript via mshta in the Lumma chain
Defense Evasion	T1218.005 Mshta	Proxy execution of remote or inline script
Initial Access	T1566 Phishing	Link and attachment lure delivery
Command and Control	T1105 Ingress Tool Transfer	Loader pulls the final payload

Detection Signals

These are behaviours to hunt for rather than fixed indicators — ClickFix infrastructure and payloads rotate constantly.

A clipboard write immediately followed by Run-dialog activity. Inspect HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU for pasted command strings.
Process ancestry of explorer.exe spawning powershell.exe, mshta.exe, cmd.exe or wscript.exe with no document being opened.
PowerShell launched with -w hidden, -enc, -nop or IEX (New-Object Net.WebClient).DownloadString to a remote host.
mshta.exe executing a remote URL or inline vbscript:.
At the web layer, pages calling navigator.clipboard.writeText on a fake CAPTCHA or verification UI.

Detection & Mitigation

Teach the one rule. No legitimate CAPTCHA or verification step ever asks a user to paste a command into Run, PowerShell or a terminal. Make that message explicit and make reporting easy.
Constrain the interpreters. Restrict the Win+R Run dialog and command interpreters for standard users where feasible; enable PowerShell Constrained Language Mode, script-block and module logging, and transcription.
Application control. Use WDAC or AppLocker to block mshta.exe and unsigned script execution where they are not required.
EDR analytics. Alert on the explorer-to-interpreter chain, hidden or encoded PowerShell, and clipboard-to-Run correlation.
Reduce lure delivery. Email and web filtering and browser isolation cut down on the pages that start the chain.

Defend Against Social-Engineering Intrusions

Mjolnir Security helps organisations close the gap that techniques like ClickFix exploit — the moment a user is tricked into running attacker code.

Security AwarenessThreat HuntingEndpoint HardeningIncident ResponseMDR Services

Threat Hunting as a Service Proactive hunting for the explorer-to-interpreter chains, RunMRU paste artifacts and encoded PowerShell that mark ClickFix activity.
Endpoint Hardening Review Assessment of PowerShell logging, application control and interpreter restrictions against copy-paste execution.
24/7 Incident Response Rapid containment and forensic analysis when a social-engineering intrusion is suspected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026