The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A ClickFix attack tricks someone into running an attacker-supplied command on their own device. A fake CAPTCHA, browser error, or meeting problem tells the person to copy or paste instructions into a trusted utility such as Windows Run or PowerShell. That human action can bypass defenses that focus only on blocking downloads, so protection needs to address the web page, command execution, stolen credentials, and the response to suspicious activity.
What is a ClickFix attack?
ClickFix is a social-engineering technique: instead of relying only on a file download or software vulnerability, an attacker persuades a person to carry out the first execution step. CrowdStrike author Hananel Livneh describes it as “a social engineering technique that turns the victim into the mechanism for executing an attack.”
As an Amazon Associate I earn from qualifying purchases.
The lure claims that the user must fix a problem or complete a check. It might imitate a video-conferencing error, browser verification, fake CAPTCHA, or system message. The instructions then direct the user to run a command, sometimes after malicious JavaScript has copied it to the clipboard. Microsoft and CrowdStrike document campaigns delivered through phishing, malicious ads, and compromised or malicious websites.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe name describes the trick, not one fixed payload or operating system. While many examples use Windows utilities, both CrowdStrike and Microsoft have documented activity affecting macOS as well.
#1 Best Overall
How does a ClickFix attack work?
The sequence can be understood as five linked stages. The attacker needs the user to carry out the execution step, but the command may then retrieve and launch additional tools.
- Lure: The person reaches a malicious or compromised page, often through a phishing message, advertisement, or link. The page presents an apparent technical issue or verification task.
- Copy or clipboard action: The page displays a command and may use JavaScript to place it on the clipboard. The user is told to copy it or paste what appears to be an ordinary verification step.
- User execution: The instructions direct the person to a trusted operating-system utility, such as Windows Run, PowerShell, Terminal, or another command interface. The user runs the command believing it will resolve the displayed issue.
- Payload delivery: The command can invoke a legitimate interpreter—such as PowerShell or VBScript—to retrieve or execute further code. Attackers may obfuscate the page’s JavaScript or commands, and some observed payloads have been loaded in memory through legitimate binaries.
- Follow-on intrusion: Depending on the campaign, the next stages can include malware deployment, credential theft, persistence, command-and-control communications, data theft, or access to other systems.
Microsoft’s 2025 analysis describes payloads including infostealers, remote-access tools (RATs), loaders, and rootkits. The eventual outcome depends on the command, device, and later stages; not every lure or attempted chain necessarily produces a successful infection.
Rank #2
- PREMIUM-QUALITY RECORD BOOK FOR DEALERS & COLLECTORS: Clever Fox Firearms Record Book is designed to help professional firearm dealers keep detailed and legally compliant acquisition and disposition information.
- 129 PAGES WITH 1,342 NUMBERED ENTRIES TOTAL: There are 129 pages in this firearm log book with 1,342 numbered entries total. Each pre-printed entry allows you to record the firearm’s description, as well as receipt and disposition info.
- LARGE FORMAT & PLENTY OF SPACE FOR EVERY DETAIL: This firearm record book comes in large format and measures 10 by 7 inches, so you have lots of space to make detailed records and add all the information you need.
- STORAGE POCKET, DURABLE HARDCOVER & THICK NO-BLEED PAPER: This gun record book features a pocket for loose papers, a pen loop, an elastic band, and a bookmark. The hardcover is made of durable vegan leather. The pages are thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE: We will exchange or refund your book of firearms if you aren’t satisfied with your personal firearms record book for any reason. Reach out to us via message to refund your personal gun log book.
What recent campaigns show
CrowdStrike’s 2026 case examples
CrowdStrike reported that in July 2026, STARDUST CHOLLIMA very likely targeted an employee at a financial-services organization using infrastructure made to resemble a video-conferencing site. CrowdStrike assessed that the employee almost certainly encountered a fake technical issue and command. Execution triggered a PowerShell/VBScript chain that deployed two previously unknown malware families, GeniexLoader and GeniexRAT.
CrowdStrike also reported that Falcon Complete MDR detected likely VOODOO BEAR intrusions in May and June 2026 affecting employees believed to be Ukrainian at organizations in France, the United States, and Canada. CrowdStrike assessed that the actor almost certainly used fake CAPTCHAs shown to Ukrainian visitors of compromised Ukrainian websites. Those prompts induced PowerShell commands that downloaded a VBScript payload. These are CrowdStrike’s assessments, not proof that every detail of the activity is certain.
Rank #3
CrowdStrike’s September 29, 2026 article attributes a 563% increase in incidents involving fake CAPTCHA lures in 2025 to its 2026 Global Threat Report. The figure concerns incidents involving that lure type in 2025; it is not a measure of all ClickFix activity.
Microsoft’s Lampion example—and an important limit
Microsoft’s 2025 case study describes a phishing ZIP/HTML route leading to a fake Portuguese tax-authority site, followed by PowerShell and staged VBScript activity. In the sample Microsoft investigated, the final Lampion malware was not delivered: the download command was commented out. The case illustrates how a ClickFix-style chain may be staged without establishing that the intended final payload infected the device.
How CrowdStrike describes its defenses
CrowdStrike maps its products and services to different points in the attack chain. The table summarizes the vendor’s descriptions; it is not an independent efficacy comparison or a guarantee that any particular attack will be stopped. The source does not establish that every named module is included in every deployment, and it does not verify exact SKU packaging or availability.
| Attack stage | CrowdStrike offering | Vendor-described role |
|---|---|---|
| Web session, before execution | Falcon Seraphic Enterprise Browser | Provides visibility and enforcement inside the browser; CrowdStrike says it can disrupt malicious web behavior and the copy-and-paste mechanism. |
| Command or payload execution | Falcon Prevent and Falcon Insight XDR | Can identify and prevent suspicious PowerShell, VBScript, process, command-line, and other behavioral activity associated with the chain. |
| Credential abuse and lateral movement | Falcon Identity Threat Protection | Can help detect and stop credential abuse and movement to other systems after credentials are compromised. |
| Cross-domain visibility | Falcon Next-Gen SIEM | Can correlate endpoint, identity, browser, cloud, and other telemetry to help connect activity that might otherwise be seen separately. |
| Hunting and incident response | Falcon Adversary OverWatch and Falcon Complete | CrowdStrike describes continuous threat hunting, investigation, containment, and remediation across the environment. |
The practical value of this layered approach is that a failed browser control does not have to be the last chance to catch an attack: execution behavior, identity activity, and correlated signals can create further opportunities to detect and respond. Those layers reduce opportunities for an intrusion to progress; they do not guarantee prevention, and the appropriate controls depend on an organization’s deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What users and IT teams can do
If a page tells you to run a command
- Stop rather than paste. A website that asks you to open Run, PowerShell, Terminal, or another command utility and execute text is a warning sign. Do not run instructions just because a page calls them a CAPTCHA, verification, or repair.
- Verify through a known channel. If the page claims a meeting, account, or application has a problem, open the service using a saved bookmark or known official address, or contact your IT team through a trusted route. Do not rely on contact details or links presented by the suspicious page.
- Report the page or message. Share it with your organization’s security or IT team using its established reporting process. If you already ran the command, say so promptly and include what you remember; avoid trying to investigate or remove suspected malware on a managed device unless your IT team directs you.
For administrators
Microsoft recommends user education and hardening device configurations. For example, an organization may disallow the Windows Run dialog for users who do not need it for daily work. That is a context-dependent control, not a universal fix: administrators should assess operational needs and protect other command-execution paths too. Microsoft also describes Defender XDR protections at multiple stages.
On macOS, CrowdStrike’s technical material illustrates hunting for ClickFix-like activity involving shell, curl, xattr, and chmod. Those tools have legitimate uses; their appearance alone does not establish an attack. Security teams should evaluate process relationships, command details, timing, and surrounding endpoint activity rather than treating a single utility as conclusive evidence.
For organizations using CrowdStrike, the defensive mapping suggests checking which browser, endpoint, identity, SIEM, and response capabilities are actually deployed and configured. A name in a product family should not be assumed to mean that a specific control is licensed, enabled, or operating in every environment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Sources and scope
- CrowdStrike, “Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them,” September 29, 2026 — attack flow, CrowdStrike defense descriptions, campaign assessments, and the 2025 fake-CAPTCHA statistic.
- Microsoft Security Blog, “Think before you Click(Fix): Analyzing the ClickFix social engineering technique,” August 21, 2025 — delivery routes, observed payload categories, the Lampion example, and mitigation context.
- U.S. Department of Health and Human Services, “ClickFix Attacks Sector Alert (TLP:CLEAR),” October 29, 2024 — alert describing users induced to copy and execute code from fake browser alerts.
- CrowdStrike, “Enhanced Network Visibility: Falcon macOS Sensor Updates,” 2026 — technical example of macOS hunting telemetry relevant to ClickFix-like behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
