ClickFix: The Attack That Talks You Into Hacking Yourself

Key points

• Microsoft's security team reported ClickFix as the most common initial access technique it saw over the past year.
• The trick disguises itself as a routine 'prove you're not a robot' check on a web page.
• The page secretly copies an attacker's command onto the victim's clipboard, then coaches them to paste it into a terminal.
• No software flaw is exploited: the victim runs the malicious command themselves, which sidesteps many security tools.
• Awareness training and blocking the Windows Run box for standard users are the cheapest defences.

The most common way into a company last year was not a clever zero-day, meaning a secret software flaw the maker didn't know about. It was a polite request.

A web page tells you to prove you are human. As you read the instructions, the page quietly slips a line of computer code onto your clipboard. Then it walks you through opening a terminal, which is the plain text window that lets you type commands directly to your computer, and pasting the code in.

You press Enter. You have just installed the malware yourself.

The technique is called ClickFix, and according to reporting in The Hacker News drawing on Microsoft's own numbers, it was the single most common way criminals got their first foothold inside companies over the past year.

What actually happens on the screen?

A fake verification page mimics the familiar CAPTCHA boxes (those little puzzles that check you are not a bot). Instead of asking you to click traffic lights, it says something has gone wrong and gives you 'repair steps'.

Step one: press the Windows key and R. Step two: press Ctrl and V to paste. Step three: press Enter.

What the victim pastes is a command the attacker's script has already tucked into the clipboard. It usually reaches out to a server the criminals control, downloads a payload, and runs it. From that moment, the attacker is on the machine.

Why is this working so well?

Because it skips the parts of an attack that security tools are best at catching. There is no dodgy attachment for a mail filter to sniff. No exploit code hammering a browser. The victim's own hands type the final instruction.

Antivirus software is trained to be suspicious of programs that arrive from outside. It is much less suspicious of a person voluntarily opening the Run box and typing.

It is, in the plainest terms, phishing (fake messages designed to trick people) that has moved off email and onto the web page itself. The old advice, 'don't click links in emails you didn't expect', doesn't quite cover 'don't paste things a website told you to paste'.

Who is being targeted?

Everyone, but especially office staff at ordinary companies. The lures are mundane on purpose: a document that won't open, a video that won't play, a meeting link that seems broken. The 'fix' is always the same shape. Copy this. Paste that. Press Enter.

Microsoft's telemetry, drawn from its Defender products across millions of endpoints, put ClickFix ahead of classic phishing emails and drive-by downloads as the number one starting point for intrusions it tracked.

What should ordinary people do?

If a website ever tells you to open the Run box, or PowerShell, or a terminal, and paste something in, close the tab. No legitimate site does this. Not Google. Not your bank. Not Microsoft. Not a CAPTCHA.

That single rule defeats the entire technique.

Criminals are not chasing novelty. They are chasing repeatability. ClickFix is popular for the same reason a con artist reuses a good script: it keeps working, and it costs almost nothing to run again tomorrow.