ClickFix: The Attack That Talks You Into Hacking Yourself
Microsoft says the fake 'prove you're not a robot' trick was the single most common way criminals broke into companies last year. The clever bit is that the victim does the hard work.
Key points
- Microsoft's security team reported ClickFix as the most common initial access technique it observed over the past year.
- The trick disguises itself as a routine 'prove you're not a robot' check on a web page.
- The page secretly copies an attacker's command onto the victim's clipboard, then coaches them to paste it into a terminal.
- No software flaw is exploited: the victim runs the malicious command themselves, which sidesteps many security tools.
- Awareness training and blocking the Windows Run box for standard users are the cheapest defences.
The most common way into a company last year was not a clever zero-day, meaning a secret software flaw the maker didn't know about. It was a polite request.
A web page tells you to prove you are human. While you read the instructions, the page quietly places a line of computer code onto your clipboard. Then it walks you through opening a terminal, the plain text window that lets you type commands directly to your computer, and pasting the code in. You press Enter, and you've just installed the malware yourself.
The technique is called ClickFix, and according to reporting in The Hacker News drawing on Microsoft's own numbers, it was the single most common way criminals got their first foothold inside companies over the past year. We've tracked it since our first ClickFix story on 28 May 2026, and a Windows Terminal variant we covered on 31 August shows the method keeps finding new surfaces.
What actually happens on the screen?
A fake verification page mimics the familiar CAPTCHA boxes, those little puzzles that check you are not a bot. Instead of asking you to click traffic lights, it says something has gone wrong and gives you 'repair steps': press the Windows key and R, then Ctrl and V to paste, then Enter.
What the victim pastes is a command the attacker's script has already placed on the clipboard. It reaches out to a server the criminals run, fetches a payload and executes it. From that moment, the attacker has code running on the machine.
Why is this working so well?
Because it skips the parts of an attack that security tools catch best. There's no dodgy attachment for a mail filter to sniff, no exploit hammering a browser. The victim's own hands deliver the final instruction.
Antivirus software is trained to be suspicious of programs arriving from outside. A person voluntarily opening the Run box and pasting something in looks quite different to a scan engine.
This is phishing, fake messages designed to trick people, that has migrated off email and onto the web page itself. The old advice about not clicking unexpected links doesn't cover 'don't paste things a website told you to paste'.
Who is being targeted?
Everyone, but especially office staff at ordinary companies. The lures are mundane on purpose: a document that won't open, a video that won't play, a meeting link that seems broken. The 'fix' is always the same shape: copy this, paste that, press Enter.
Microsoft's telemetry, drawn from its Defender products across millions of endpoints, put ClickFix ahead of classic phishing emails and drive-by downloads as the number one starting point for intrusions it tracked.
| Attack step | What the victim sees | What is really happening |
|---|---|---|
| The lure | A CAPTCHA or error page | Attacker-controlled site |
| The copy | 'Click here to verify' | A command is placed on the clipboard |
| The paste | 'Open Run and paste this' | Malware download and execution |
| The result | Page says 'verified' | Attacker has code running on the PC |
Should you worry?
If a website ever tells you to open the Run box or a terminal and paste something in, close the tab. No legitimate site does this. Not Google, not your bank, not Microsoft. That single rule defeats the entire technique.
Criminals aren't chasing novelty. They're chasing repeatability. ClickFix is popular for the same reason a con artist reuses a good script: it keeps working and costs almost nothing to run again tomorrow. The uncomfortable truth for security teams is that no patch fixes this one.
