ClickFix: How Fake CAPTCHAs Trick Users Into Self-Infection

One of the most effective attack techniques of the past two years works without an exploit, without a zero-day, and without a single click on a malware download. With ClickFix, the victim infects themselves — they open the Windows Run dialog, paste a command, and press Enter. That is precisely the appeal for attackers: there is no file for antivirus to intercept and no malicious attachment to slip past a mail filter. The human being is the execution tool.

According to the Microsoft Digital Defense Report 2025, ClickFix was the most frequently observed initial-access technique during the reporting period, accounting for roughly 47 percent of cases — ahead of classic phishing at 35 percent. That is remarkable for a scheme first documented only in March 2024. For CISOs and security leaders, the takeaway is clear: purely technical defenses fall short here, because the attack is deliberately designed to bypass controls and land directly on the user.

How a ClickFix Attack Unfolds

The underlying pattern is always the same and can be described in a few steps:

1. The victim lands on a prepared page — often a fake CAPTCHA imitating reCAPTCHA, Cloudflare Turnstile, or a Discord verification. Fake Windows Update screens or "document-cannot-be-loaded" error messages are also used.
2. When the user supposedly clicks "I'm not a robot," JavaScript silently writes a command into the user's clipboard in the background.
3. The page displays a "verification guide": press Windows + R, then Ctrl + V, then Enter. This is framed as a harmless technical step to complete the check.
4. The victim follows the instruction. The pasted command typically launches powershell.exe, mshta.exe, or cmd.exe and pulls the actual malware directly into memory.

The psychological trick sits in the third step. The user believes they are solving a problem — hence the name ClickFix. The keystroke combination feels like a technical formality, not a command execution. This reframing of a dangerous action as a mundane "fix" is exactly what makes the technique so successful.

Why the Technique Bypasses Technical Controls

ClickFix is so hard to stop because it sidesteps the usual checkpoints where security solutions operate. There is no executable file written to disk that could be scanned — the malicious code is loaded straight into memory (fileless). The user also invokes legitimate, digitally signed Windows tools such as PowerShell or mshta, which a security solution cannot block wholesale without disrupting normal operations. This approach is known as Living off the Land.

On top of that, the decisive click happens outside the browser. Browser sandboxing and email filters only see the innocuous-looking web page; the actual execution takes place in the operating system, triggered by the user themselves. MITRE has since captured the technique as its own category: T1204.004 – User Execution: Malicious Copy and Paste.

ClickFix distributes a wide range of malware — from infostealers such as Lumma Stealer and AMOS (Atomic macOS Stealer), to remote access trojans like AsyncRAT and XWorm, to loaders that pave the way for ransomware. Originally aimed at Windows, the scheme was extended to macOS users in 2025.

Distribution Channels: From Malvertising to Fake Support

ClickFix pages reach their victims through several channels. The most common are malvertising and SEO poisoning, where manipulated search results or ads direct users to the fake CAPTCHA pages. A second route is the compromise of legitimate websites, for instance through vulnerable WordPress plugins, so that the fake check appears on an otherwise trusted domain. The third channel is targeted phishing via email or through fake video-conference invitations.

A particularly dangerous variant combines ClickFix with direct fake support: attackers flood a victim's inbox with newsletter sign-ups, then call or message via Microsoft Teams posing as IT support and walk the person step by step through the supposed "troubleshooting." In this context, ClickFix closely resembles classic social engineering attacks, where authority and time pressure override the victim's critical judgment.

How Organizations Can Protect Themselves

Because ClickFix targets the human, the defense has to work on several layers at once. Technical measures alone are not enough, but neither is awareness training on its own. The following building blocks have proven effective:

• Restrict the Run dialog: Group Policy can disable the Windows Run dialog (Win+R) for standard users. This removes the central entry point of many ClickFix campaigns without noticeably affecting daily work.
• Harden PowerShell: Constrained Language Mode, script block logging, and a restrictive execution policy (AllSigned/RemoteSigned) make it harder to run downloaded scripts while creating visibility for the SOC.
• Attack Surface Reduction: ASR rules in Microsoft Defender block the execution of obfuscated scripts and the launch of processes from mshta or PowerShell, as is typical for ClickFix.
• Teach awareness concretely: Employees need to internalize one golden rule — a real CAPTCHA check will never ask you to press key combinations or paste commands. Anyone prompted to use Win+R and Ctrl+V is inside an attack. That message is far more memorable than an abstract warning about "suspicious websites."
• Test attacks realistically: In an adversary simulation, you can verify how staff and endpoint protection respond to a real ClickFix chain — from the fake CAPTCHA page to execution. This exposes gaps before a real attacker does.

Conclusion

ClickFix is a textbook example of why the line between technical and human security is blurring. The attack succeeds because it disguises a dangerous action as a harmless fix while bypassing every signature-based detection. The most effective defense is a combination of consistent system hardening — above all restricting the Run dialog and hardening PowerShell — and an awareness culture that conveys one clear, memorable rule. No legitimate verification process will ever ask you to paste a command into your system. Keep that rule in mind, and you take away ClickFix's foundation.