How ClickFix Tricks You into Hacking Yourself

Have you ever visited a website and been asked to prove you’re not a robot, fix a browser permission, or accept even cookies? What if that innocent-looking prompt was actually a trap designed by cyber criminals to steal your data or infect your device?

What is ClickFix?

ClickFix is a social engineering technique that tricks users by mimicking familiar system and browser interactions. It bypasses typical security defences and delivers malware successfully. Although it gained wide attention around 2024, evidence shows it was in use even before then.

Fake CloudFlare CAPTCHA Challenge

A Real-World Analogy: Distraction Theft by a Fake Security Guard

Imagine arriving at a crowded event when a person dressed as a security guard stops you, claiming to conduct random checks, and asks to open your bag. While you comply with the inspection, an accomplice grabs your wallet and disappears into the crowd.

In this analogy:

1. The "security guard" is the deceptive reCAPTCHA prompt.
2. Opening your bag is like executing the scripts that ClickFix tricks you into running.
3. The accomplice stealing your wallet is like malware quietly infecting your device and stealing your data.

Just as trusting a person impersonating an authority figure can cost you your valuables, blindly following such prompts can cost you your data.

How does it work?

The ClickFix Attach Chain Process

Step 1: Initial Contact - The user clicks on a malicious link that was sent via a phishing email or advertisement, or they visit a compromised website. This link directs them to a harmful landing page.

Step 2: Initial Bait - The landing page displays a convincing prompt, such as an error message or CAPTCHA, that is designed to gain the user's trust and create a sense of urgency.

Step 3: User Interaction and Command Execution - The prompt instructs the user to perform specific steps like pressing a key combination to open system tools (Windows Run dialog, PowerShell, or Terminal), then copying a hidden malicious command to their clipboard and pasting it into the tool for execution. This action initiates the download of malware.

Fake pop-ups and a snippet of a malicious script

Step 4: Payload Delivery - The executed command silently downloads and installs malware, typically using living-off-the-land binaries (LOLBins) such as PowerShell or mshta.exe to evade detection.

Step 5: C2 communication - Once installed, the malware establishes communication with the threat actor's Command and Control (C2) server, allowing them to issue further instructions, move laterally within networks, or exfiltrate data.

Step 6: Attacker Control - Through this C2 connection, the attacker gains remote access to the compromised device, which enables them to steal data, deploy additional malware, or maintain stealthy persistence for long-term control without detection.

How Can You Spot a ClickFix Campaign?

You might be targeted if you notice any of the following:

1. Unexpected urgent pop-ups or banners may appear, prompting you to fix permissions or verify your identity.

1. You may receive prompts that instruct you to launch system tools such as Run, PowerShell, or Terminal and to copy-paste commands.
2. You may also encounter messages that mimic legitimate brands, with odd URLs or designs.

1. The messages may request unusual permissions without providing clear explanations.
2. Complex verification prompts may appear on unrelated sites.
3. You may encounter prompts immediately after clicking on suspicious links or ads.

If you see these signs, avoid following instructions, close the site or app, and contact IT support.

How to Avoid Becoming the Next Victim of ClickFix Campaigns

Prevention Tips

Training and Spreading Awareness

1. Learn how ClickFix tricks users into executing malicious commands. Stay sceptical of unexpected prompts asking to copy/paste commands or change permissions.
2. Train employees and users regularly about social engineering tactics, emphasising caution with unfamiliar links and prompts.

Restrict Access and Harden Systems

1. Limit or disable access to system tools like the Run dialogue, PowerShell, and Terminal for non-admin users.
2. Configure execution policies to block scripts from untrusted sources and restrict unnecessary clipboard access.
3. Enforce the principle of least privilege (PoLP) so users only have access they urgently require.

Deploy Advanced Security Controls

1. Use endpoint detection and response (EDR) solutions that monitor suspicious command execution and block known malicious domains.
2. Employ URL filtering and web gateways to prevent access to malicious sites and block malvertising.
3. Implement multi-factor authentication (MFA) to reduce risk from credential theft.

Maintain Cyber Hygiene

1. Keep software, browsers, and security solutions updated with the latest patches.
2. Regularly perform vulnerability assessments and penetration testing.

Mitigation and Response Recommendations

Immediate Actions

1. Disconnect affected devices from the network to limit spread or ongoing stealthy activities.
2. Run full malware scans using updated endpoint security tools.
3. Check for unauthorised commands executed via Run, PowerShell, or Terminal logs and block suspicious activity.

Contain and investigate

1. Identify and isolate systems communicating with known Command and Control (C2) domains.
2. Analyse logs for suspicious network connections, lateral movement, or data exfiltration attempts.
3. Use forensic tools to understand the malware’s behaviour and scope for compromise.

Remediation and Recovery

1. Remove malware using trusted cleaning tools or perform a system restore/rebuild if infected.
2. Reset potentially compromised credentials and enforce MFA.
3. Review and tighten user privileges to reduce future risks.

Strengthen defences post-incident

1. Update security policies to restrict command-line tool usage to system administrators.
2. Conduct targeted user training on recognising and reporting suspicious prompts.
3. Implement continuous monitoring and alerting for abnormal user or system behaviour.

If you believe you may have fallen victim to this technique, please report it immediately to the following email address: [email protected], and we will get back to you shortly.