ClickFix
ClickFix is a social engineering technique. It typically shows a popup over a webpage instructing the viewer to run a system command that will install malware.[1][2] It often contains an instruction to open the Run dialog on Microsoft Windows using the â Win+R shortcut.
History
[edit]The first ClickFix version was discovered in October 2023.[3]
According to Hudson Rock, ClickFix often forms a feedback loop, using credentials stolen by infostealers to compromise administrative accounts on legitimate websites and host new ClickFix lures.[4] In July 2026, researchers detailed an incident where stolen WordPress credentials led to a ClickFix campaign on an Artlist subdomain using Polygon smart contracts (EtherHiding) for dynamic payload routing.[5]
Defenses
[edit]In March 2026, Apple added a mitigation to macOS to prevent ClickFix style attacks.[6][7] In April, a modified variant using the applescript:// URI scheme to bypass the use of the Terminal application was found.[8]
In October 2026, Google Chrome introduced a feature to send the clipboard contents to the Google Safe Browsing service, after removing personal data. If the service returns that the contents contain a ClickFix command, the browser will present a warning.[9][10]
Usage
[edit]ClickFix was used in the 2026 ransomware attack on Berlin.
In 2026, the Dutch municipality of Epe was hacked through a ClickFix page, which then allowed attackers to escalate privileges using the badly secured break glass account.[11]
See also
[edit]References
[edit]- â FadilpaĆĄiÄ, Sead (2025-11-07). "Experts warn ClickFix malware attacks are back, and more dangerous than ever before - here's how to stay safe". TechRadar. Retrieved 2026-04-09.
- â Goodin, Dan (2025-11-11). "ClickFix may be the biggest security threat your family has never heard of". Ars Technica. Retrieved 2026-04-09.
- â Fermo, Vincent; Gsas '26 (2025-10-15). "ClickFix: How Hackers Use 'Verification' to Steal Your Information". Fordham University Information Security and Assurance. Retrieved 2026-04-10.
{{cite web}}: CS1 maint: numeric names: authors list (link) - â "From Victim to Vector: How Infostealers Turn Legitimate Businesses into Malware Hosts". Hudson Rock. 2025-12-30. Retrieved 2026-07-31.
- â "How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist". InfoStealers. 2026-07-14. Retrieved 2026-07-31.
- â Toulas, Bill. "Apple adds macOS Terminal warning to block ClickFix attacks". BleepingComputer. Retrieved 2026-04-09.
- â "I put Apple's new macOS ClickFix warnings to the test and they actually worked â now I want them on Windows too". Tom's Guide. 2026-03-31. Retrieved 2026-04-09.
- â "New ClickFix variant bypasses Apple safeguards with oneâclick script execution". CSO Online. Retrieved 2026-04-09.
- â "Our latest defenses against evolving web scams". Google. 2026-10-20. Retrieved 2026-10-23.
- â Parmar, Mayank. "Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks". BleepingComputer. Retrieved 2026-10-23.
- â Baak, Colin (2026-06-08). "Onbeveiligd noodaccount bleek achilleshiel bij hack gemeente Epe". ICTMagazine.nl (in Netherlands Dutch). Retrieved 2026-10-27.
Further reading
[edit]- "Think before you Click(Fix): Analyzing the ClickFix social engineering technique". Microsoft Security Blog.