ClickFix: The Fake Error Pop-Up That Tricks You Into Hacking Yourself
A scam that launched in 2024 has grown into a thriving criminal marketplace. Researchers say standard antivirus tools are missing it almost entirely, and they have built a new detection method to fill the gap.
Key points
- ClickFix, a social-engineering attack that first appeared in 2024, now has full attack kits selling on criminal forums for $250 a month or $1,800 for a lifetime licence.
- Researchers at Reversing Labs tested a new detection rule against a 422-billion-sample library and found it caught at least 123 confirmed ClickFix attacks that every mainstream antivirus engine had missed.
- A January 2026 variant called "CrashFix", identified by Microsoft, deliberately crashes the victim's browser before showing a fake fix prompt.
- Reversing Labs is releasing their detection rule as free, open-source software that any security team can use.
- Training staff to recognise fake browser updates and fake CAPTCHA checks remains a meaningful layer of defence.
A pop-up appears on your screen. It looks like a Windows error message, tells you something's gone wrong, and walks you through a fix: copy this command, open your terminal (the text-based control panel built into every computer), paste it in, press Enter. You've just handed control of your machine to a criminal.
That is ClickFix. Devious and spreading fast.
It works because it skips the part where a virus sneaks onto your computer. You run the harmful code yourself, which means normal antivirus software sees nothing alarming. From the computer's point of view, a person ran a script, and people run scripts all the time.
How did this become such a big problem so quickly?
ClickFix grew a business model around it. Complete attack kits, including regular software updates and features designed to slip past antivirus tools, now sell openly on criminal forums. Reversing Labs found kits priced at $250 a month or $1,800 for a permanent licence. That pricing means a would-be attacker needs almost no technical skill: pay the subscription, follow the instructions, launch the campaign.
The most common payload (the harmful software that ultimately lands on a victim's machine) is Lumma Stealer, a program that quietly copies passwords and browser cookies. But Reversing Labs documents a shift: criminals are increasingly delivering RATs (remote-access trojans, software that lets an attacker control a computer as though they were sitting in front of it) rather than simple password-stealers. That's a real escalation. Attackers are moving from quick credential theft toward sustained, quiet occupation of a victim's machine, with lateral movement and data exfiltration to follow.
The attack keeps evolving. Microsoft spotted a variant called CrashFix in January 2026 that crashes your browser on purpose, then offers a fake repair prompt, making victims more likely to follow instructions without thinking. We covered the fake-CAPTCHA cousin of this technique on 8 July 2026, when Elastic Security Labs tracked a campaign tricking Mexican bank customers into pasting a malicious command from a bogus "prove you're human" page.
Should you worry about YARA catching what antivirus misses?
The detection fix Reversing Labs proposes is called YARA, a pattern-matching framework (think of it as a precise search tool for malware characteristics) that examines the fake lure page itself before any harmful command is ever run. Standard antivirus tools wait for a bad file to arrive. This approach spots the trap before the victim steps into it. Validated against that 422-billion-sample library, the new rule flagged 123 real ClickFix lures that had slipped past every other scanner. Reversing Labs is releasing it as open-source, so any security team can deploy it.
For ordinary employees, the warning is short: if any webpage or pop-up asks you to copy a command and paste it into your computer, stop. That request is the attack. No legitimate software update works that way.
Security teams can also restrict PowerShell (a powerful command tool built into Windows that ClickFix relies on heavily) from running freely, and monitor for unusual activity that suggests a command was copy-pasted rather than typed by IT staff.
The blunt assessment from this beat: ClickFix isn't a novel AI attack or an exotic zero-day. It's confidence trickery dressed in a terminal window, and the reason it keeps working is that most organisations still haven't trained their staff to treat a copy-paste prompt as a red flag. The YARA rule helps, but the cheaper fix is awareness.
