23 Feb Watch Out for the ClickFix Phishing Scheme

Phishing remains the most effective tool in a hacker’s kit, and it keeps finding new ways to get past the defenses built to stop it. The latest version, known as ClickFix, has grown fast enough that threat intelligence researchers now expect it to be one of the dominant ways attackers gain initial access to networks through 2026, with reported case volume up more than 500% over the past year.

What makes ClickFix dangerous isn’t a new piece of malware. It’s a new way of getting a user to install the malware themselves.

What ClickFix Actually Does

Traditional phishing gets someone to click a bad link or type credentials into a fake login page. ClickFix works differently: it gets the user to run a malicious command on their own computer, using tools already built into their operating system.

The lure usually looks like a routine step. A fake CAPTCHA verification. A browser error message asking you to “fix” the problem. A verification screen for a document or meeting link. Instead of clicking a button, the user is instructed to copy a short command and paste it somewhere on their system, then run it. That single action can hand an attacker remote access, install an infostealer, or deliver ransomware, and because the user performed the action themselves, many automated security tools never flag it as suspicious.

The original version of this technique told victims to paste commands into the Windows Run dialog. It has since shifted toward the Windows Terminal instead, largely because that route leaves less of a trace in the logs security teams typically check first. ClickFix has also spread beyond Windows: Apple added a mitigation for ClickFix-style attacks on macOS as recently as March 2026, and researchers have already found a variant built to work around it.

Why It Works So Well

ClickFix succeeds because it exploits trust in something that isn’t normally associated with phishing: routine technical friction. Most people have clicked through a CAPTCHA or dismissed a browser error without a second thought. ClickFix turns that habit into the attack itself.

It also benefits heavily from AI-generated brand impersonation, which makes the fake verification screens, error messages, and lookalike sites look far more convincing than older phishing attempts. Because the malicious action happens through a legitimate system tool rather than a suspicious download, there’s often no file for antivirus software to scan and no obviously bad link for a spam filter to catch.

This technique has moved well past opportunistic criminal use. Security researchers have tied it to nation-state groups conducting espionage campaigns, and it’s spawned named variants like FileFix and DownloadFix that use the same trust-based trick with different everyday tools.

How to Defend Against It

Train specifically on ClickFix, not just phishing in general. Employees who can spot a suspicious email often still fall for a fake “fix it” prompt, because it doesn’t look like the phishing they’ve been trained to recognize. Simulation exercises that include this specific tactic are more effective than generic phishing awareness training alone.

Set a zero-trust policy for unexpected verification steps. No legitimate CAPTCHA, browser update, or document verification requires a user to open the Run dialog, Terminal, or command prompt and paste something in. Make that rule explicit and repeat it often: if a “fix” asks you to paste and run a command, stop and verify through another channel first.

Restrict who can run commands from the Run dialog and Terminal. Group policy controls can limit this to IT staff and reduce how much damage a successful ClickFix attempt can do on a standard employee’s machine.

Enable PowerShell script block logging. This isn’t on by default, but it’s one of the most useful tools for identifying and investigating a ClickFix attempt after the fact, since it records what a malicious script actually executed.

Use monitoring that watches behavior, not just known threats. Because ClickFix relies on legitimate tools rather than obviously malicious files, endpoint detection needs to flag unusual command execution and network activity, not just known bad signatures. Bytagig’s managed cybersecurity services cover this kind of behavioral monitoring alongside standard endpoint protection.

Get Ahead of ClickFix Before It Reaches Your Team

ClickFix is a fast-moving threat, and most businesses don’t have the internal resources to track every new variant as it emerges. Bytagig’s cybersecurity team combines endpoint monitoring, employee training, and policy controls into one managed approach so you’re not chasing this alone.

If you’re not sure whether your current defenses would catch a ClickFix attempt, schedule a free consultation or call (833) 465-5913.

Share this post: