The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Protect against ClickFix with layered controls: teach staff never to paste a website’s command into Run, PowerShell, Terminal, or a shell; limit unnecessary command execution; protect email and web traffic; collect process, script, and network telemetry; and make sure suspected executions reach your incident-response team quickly. No single endpoint product or awareness reminder covers every stage.
What ClickFix is—and what makes it different
ClickFix is a social-engineering technique that persuades a person to run an attacker-supplied command themselves. A deceptive page, pop-up, or message may pose as a browser error, software repair, or CAPTCHA challenge. It can tell the user to copy a command—or place one on the clipboard—and paste it into a trusted operating-system tool.
As an Amazon Associate I earn from qualifying purchases.
Reported routes to the lure include phishing, malvertising, and compromised websites. Commands have been aimed at Windows Run, PowerShell, Windows Terminal, and macOS shells; related variants have also used other native utilities. This means a defense focused only on blocking malicious attachments or downloads can miss activity that begins with a user executing text in a legitimate system interface.
After execution, a command may launch a script or payload. Depending on the campaign, reported consequences include stolen information or credentials, data exfiltration, remote access, further malware, lateral movement, and ransomware incidents. The payload and impact are campaign-specific, not inherent to every ClickFix lure.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The tell employees need to recognize
The defining warning sign is a webpage, pop-up, CAPTCHA, or message asking someone to paste or run a command in an operating-system tool. A familiar-looking page does not make that instruction safe. Legitimate websites should not require a command in Run, PowerShell, Terminal, or a shell to prove a person is human or repair a browser.
Give staff a simple action: stop, do not run the command, and report the prompt through the organization’s established help desk or security channel. Explain where to get help rather than leaving employees to decide whether a prompt is legitimate. Microsoft’s August 21, 2025 guidance recommends educating users to recognize social engineering and understand what they copy and paste; Singapore’s Cyber Security Agency (CSA) similarly warns about fake CAPTCHA or “Fix It” prompts and unexpected Run-dialog instructions.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Build a layered defense
1. Reduce unnecessary command execution
Inventory which roles need Run, PowerShell, Terminal, and scripting tools for approved work. Where business needs allow, restrict access for standard users and use application control or allowlisting to limit which binaries and scripts can run, and in what context. Microsoft’s guidance includes disabling Run where it is not needed, restricting native binaries launched from Run, warning about multi-line pastes in Windows Terminal, and enabling PowerShell script-block logging. The Center for Internet Security (CIS) also describes PowerShell restrictions, Windows Defender Application Control, and application allowlisting.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThese controls can disrupt legitimate administration and other workflows. Test policies with affected teams and retain an approved administrative path before broad deployment; a restriction that users or administrators must routinely bypass is unlikely to be a dependable control.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Protect the routes that deliver lures
Review email filtering for spoofed, spam, and malware messages, and enable link rechecking where available. Consider managed browsers and web or network protections that can block malicious sites and connections. Keep endpoint protection and software current. These measures reduce different opportunities for delivery or execution; they are not substitutes for execution controls or user reporting.
3. Make detection possible
Centralize endpoint process and command-line data, PowerShell script-block or other relevant logs, and network-connection telemetry. Build alerts for suspicious scripting activity and unexpected outbound connections, then assign an owner and a triage procedure to each alert. Singapore CSA recommends SIEM logging, asset visibility, continuous monitoring, and detection of anomalous connections and malicious PowerShell commands.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
On Windows, commands entered through Run may leave a record in the RunMRU registry key. Microsoft notes that failed process executions do not create an entry, so RunMRU can provide an investigative lead but cannot establish that no command was attempted or run. Combine it with endpoint and network evidence.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow the main control layers compare
| Control | What it covers | Useful evidence or action | Limit to plan for |
|---|---|---|---|
| User education and reporting | The moment a person encounters an instruction to paste or run a command. | Recognize the tell; stop and report the prompt. Microsoft and Singapore CSA recommend this type of awareness. | It depends on recognition and reporting; it does not restrict execution or detect activity after the fact. |
| Execution restrictions and application control | Whether users or processes can launch command tools, binaries, or scripts. | Restrict unnecessary access and allow approved binaries or scripts, as appropriate to role. | Can interfere with legitimate work; requires testing, maintenance, and an approved administrative path. |
| Email, browser, web, and network protection | Some delivery routes and connections to malicious sites or infrastructure. | Filter suspicious email, recheck links, and use browser or network protections. | ClickFix has also appeared through compromised websites and malvertising; delivery defenses alone do not cover user execution. |
| Endpoint detection and response (EDR) | Endpoint activity, depending on the product’s telemetry and configuration. | Investigate process and command-line activity and related behaviors. | Microsoft reported user-executed ClickFix commands on devices with EDR enabled. That observation does not establish comparative effectiveness across vendors or organizations. |
| SIEM and centralized logging | Collected endpoint, script, and network events used for monitoring and investigation. | Correlate activity, alert on suspicious behavior, and route alerts to a triage owner. | Logs are useful only when relevant data is collected, retained, and reviewed; collection alone does not stop execution. |
The sources do not establish a head-to-head efficacy ranking for these controls. Assess each one by the execution route and attack stage it covers, the process, command-line, script, and network behavior it can reveal, its effect on legitimate workflows, and the effort required to operate it. Treat any claim that one control completely prevents ClickFix as unsupported.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What reported activity figures do—and do not—show
- Microsoft Threat Intelligence and Microsoft Defender Experts reported on August 21, 2025, that they observed ClickFix campaigns affecting “thousands of enterprise and end-user devices globally every day” over the prior year. This is their campaign observation, not an independently measured global incidence rate.
- Microsoft Defender Experts also described thousands of devices per month with a ClickFix command executed despite EDR being enabled in early 2025. This is an observation of Microsoft’s own devices, not an EDR effectiveness rate across vendors or organizations.
- CIS reported that ClickFix made up “over a third” of non-malware Albert Network Monitoring and Management alerts in its first-half 2025 dataset. That proportion applies to those alerts, not to all cyberattacks.
What to do if someone ran a command
- Start the incident process promptly. Ask the user to report what happened through the established security channel and notify the incident-response team. Do not treat a successful-looking CAPTCHA or repair prompt as evidence that nothing ran.
- Establish what was executed. Collect the available endpoint and network evidence, including process and command-line records, relevant PowerShell logs, and any RunMRU entry. Treat each source as partial evidence rather than relying on one artifact.
- Assess the scope. Identify the affected device and account, determine whether related devices or identities show suspicious activity, and assess potential credential exposure, data transfer, remote access, or secondary payloads.
- Contain and recover under your response plan. Use the organization’s established procedures to contain affected devices and identities, preserve evidence, and guide recovery. The appropriate actions depend on what ran and what the investigation finds; the sources do not provide a universal incident-response playbook.
The potential for credential theft, data exfiltration, remote access, follow-on malware, and lateral movement makes a suspected execution worthy of prompt security review, even when the user is unsure whether the command completed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
