What is ClickFix, and why is it 2026's top initial-access trick?
ClickFix is a social-engineering technique that tricks a user into copying an attacker-supplied command and running it themselves, usually via the Windows Run dialog (Win+R) or a terminal, under the guise of "verifying you are human" or "fixing" an error. Because the victim executes the payload, it sidesteps many download-based defenses.
- ▸The victim is the delivery mechanism. No malicious attachment to detonate, no drive-by exploit, just a person pasting a command.
- ▸It exploded through 2024-2025. Public reporting, including Microsoft threat intelligence, attributed a large and rising share of initial-access activity to ClickFix-style lures, some telemetry described it approaching half of observed initial access. Treat the exact percentage as directional and check the source.
- ▸It maps cleanly to MITRE ATT&CK T1204 (User Execution) and typically T1059.001 (PowerShell), a well-understood pattern you can hunt for.
How does a ClickFix lure actually work, step by step?
A ClickFix lure shows a fake error or CAPTCHA, tells the user to "verify" or "fix" the problem, and walks them through pressing Win+R, Ctrl+V, and Enter. The page silently copied a malicious command to the clipboard; the keystrokes paste and run it. The whole flow feels like routine troubleshooting.
Typical sequence:
- ▸Lure surface, a fake Cloudflare or reCAPTCHA human-verification widget, a "your browser needs fixing" banner, or a booby-trapped document.
- ▸Clipboard hijack, JavaScript copies a command (often PowerShell or mshta) to the clipboard when the user clicks.
- ▸Instructions, "Press Windows+R, then Ctrl+V, then Enter," sometimes illustrated with screenshots.
- ▸Execution, the command runs in the user's context and pulls down the real payload.
Why does ClickFix bypass so many security controls?
It bypasses controls because the malicious action originates from the user, using tools already trusted on the system. There is no malicious file for email or web filters to scan at the critical moment, and the executing binaries, PowerShell, mshta, cmd, are legitimate, signed Windows components (living-off-the-land binaries, or LOLBins).
- ▸No attachment, no obvious download. The payload arrives only after the user runs the command, defeating detonation-at-delivery models.
- ▸Trusted binaries do the work. Attackers abuse LOLBins so allowlisting and signature checks see "normal" Windows tools.
- ▸Consent laundering. Because the user chose to run it, many prompts and warnings never appear.
- ▸Encoded commands hide intent. Base64-encoded or obfuscated PowerShell conceals the URL and behavior from a casual glance.
How has ClickFix evolved, and who is using it?
ClickFix has spawned variants that reuse the same paste-to-run idea through different entry points, and it is now run by financially motivated crews and, per public reporting, some state-nexus groups. The lure keeps working because it targets human behavior, not a patchable bug.
- ▸FileFix swaps the Run dialog for the File Explorer address bar, which also executes pasted commands, dodging controls aimed only at Win+R.
- ▸Fake-CAPTCHA kits seen in ClearFake and related campaigns automate the clipboard hijack across large numbers of compromised sites.
- ▸Cross-platform reach, macOS versions coax users into pasting into Terminal, and Linux variants exist, so it is not a Windows-only problem.
- ▸Weaponized documents and emails, some campaigns embed the instructions in a fake document or email body, removing the need for a lure website entirely.
- ▸Broad adoption, initial-access brokers, commodity-malware operators, and reportedly some advanced actors have all used ClickFix, which is why it surfaces across otherwise unrelated intrusions.
What does the pasted command actually do?
The pasted command is usually a small loader that reaches out to attacker infrastructure and downloads the real malware, commonly an infostealer or remote-access trojan. Public reporting has tied ClickFix campaigns to families such as Lumma Stealer, Vidar, DarkGate, NetSupport RAT, and AsyncRAT, with some chains leading to ransomware.
- ▸Stage one is small and quiet, a PowerShell or mshta one-liner that fetches stage two.
- ▸Stage two steals or persists, infostealers grab browser cookies, saved passwords, and crypto wallets; RATs open hands-on-keyboard access.
- ▸Credential theft feeds bigger attacks. Stolen session cookies and passwords enable account takeover and, downstream, ransomware. See Ransomware in 2026: What Small Businesses Keep Getting Wrong.
How do you detect ClickFix activity?
Detect ClickFix by hunting for its unavoidable fingerprints: the Run dialog's history, and browser or Office processes spawning script interpreters. The technique almost always leaves a RunMRU registry entry and an anomalous parent-child process chain that legitimate workflows rarely produce.
- ▸Watch the RunMRU key, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU records what users typed into Win+R; encoded PowerShell there is a strong signal.
- ▸Alert on suspicious process lineage, explorer.exe or a browser spawning powershell.exe, mshta.exe, or cmd.exe with outbound network activity.
- ▸Flag encoded and remote commands, PowerShell with -enc, -EncodedCommand, DownloadString, or IEX pulling from a URL.
- ▸Enable script logging, turn on PowerShell Script Block Logging (Event ID 4104) and Sysmon to capture the full command. Convert findings into durable detections, as in From Red Team Findings to Detections: Continuous Purple Teaming.
- ▸Rehearse the response for the ones that slip through, using tested runbooks like those in Incident Response Playbooks That Teams Actually Use.
Which technical controls stop paste-to-run attacks?
The strongest controls remove the tools the attack needs from ordinary users' hands. Disable or restrict the Win+R Run dialog for non-admins, block child processes from Office and browsers, and constrain PowerShell so pasted one-liners cannot fetch and run code.
- ▸Disable the Run dialog via GPO or Intune (the NoRun policy) for standard users who never need it.
- ▸Deploy Microsoft Defender Attack Surface Reduction (ASR) rules to block Office and script hosts from spawning executables and to blunt obfuscated scripts.
- ▸Enforce PowerShell Constrained Language Mode and, where possible, application control (WDAC or AppLocker) to stop arbitrary script execution.
- ▸Neutralize risky handlers, disable or restrict mshta.exe and the custom URI-scheme tricks abused by newer variants.
- ▸Harden the browser, limit clipboard-write abuse where feasible and keep browsers patched.
- ▸Filter at the network edge, block newly registered domains and known loader infrastructure so stage two cannot download even if the command runs.
How do you train users against "paste this to verify"?
Teach one durable rule: legitimate websites and error messages never ask you to press Win+R or paste a command to prove you are human. Any page that walks you through keyboard shortcuts to "verify" or "fix" something is an attack, full stop, close it and report it.
- ▸Name the exact pattern. Show real ClickFix screenshots so staff recognize the fake CAPTCHA and "fix it" prompts.
- ▸Kill the trust in troubleshooting steps. IT will never tell you to paste a command from a web page you did not initiate.
- ▸Make reporting one click. A phishing-report button lowers the cost of raising a hand.
- ▸Reinforce the human layer broadly; ClickFix is one of many identity-targeting lures covered in Deepfakes, Identity Theft, and Ransomware-as-a-Service: Defending the Human Layer in 2026.
How TuniCyberLabs helps
TuniCyberLabs hardens endpoints against ClickFix end to end: ASR and application-control baselines, Run-dialog and PowerShell restrictions, RunMRU and process-lineage detections wired into your SIEM, and awareness content built around the real lure. We validate it with authorized phishing and endpoint tests, then help your SOC turn each finding into a lasting detection.
Ask for a ClickFix and initial-access hardening assessment at /services and close the paste-to-run gap before it becomes an incident.