What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ClickFix is a social-engineering attack that disguises malware installation as a routine fix, verification step, or support instruction. It tries to persuade you to copy a command from a webpage or message and run it on your device. The prompt may look familiar, but the command—not the apparent CAPTCHA or error—is the danger.
What is ClickFix?
ClickFix is the name for a method of tricking someone into executing a command that can install or launch malware. It is not one specific malware product: attackers change the prompt, command, delivery route, and payload from campaign to campaign. Microsoft and the Center for Internet Security (CIS) describe campaigns involving information stealers and remote-access tools; the U.S. Department of Health and Human Services (HHS) also documented fake browser-update campaigns. Depending on the case, the goal may be to steal credentials or data, gain remote access, stage additional malware, or—in some observed campaigns—enable ransomware.
As an Amazon Associate I earn from qualifying purchases.
ClickFix campaigns have targeted both Windows and macOS users. Google Threat Intelligence described instructions aimed at both operating systems, including a macOS campaign involving Atomic Stealer. A particular fake CAPTCHA or command therefore should not be treated as representative of every ClickFix attempt.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow does ClickFix work?
- It draws you to a deceptive page. A phishing message, malicious advertisement, compromised website, or redirect may lead to the lure, according to Microsoft’s August 2025 account.
- It presents a plausible pretext. The page might imitate a CAPTCHA, browser verification, software update, document error, job application, or support message. It makes an unusual action appear like a small step needed to continue or solve a problem.
- It asks you to copy and run text. A button may copy a command to the clipboard, then instructions tell you to paste it into Windows Run, Windows Terminal, or another command interface. Microsoft’s guidance and the HHS alert describe this copy-and-paste pattern. A webpage asking you to run a command is not providing ordinary verification.
- The command may fetch or launch a payload. Some campaigns use built-in system tools or scripts. Microsoft’s 2025 reporting describes execution paths involving PowerShell and
mshta.exe, but commands and chains vary. Do not run a command from an untrusted prompt to inspect what it does. - The outcome depends on the campaign. A command may fail, deliver a particular payload, or lead to further malicious activity. Not every ClickFix prompt succeeds or installs the same malware.
What makes ClickFix different from an ordinary fake CAPTCHA?
The key distinction is that the prompt tries to recruit you to perform the execution step. A conventional malicious link might try to exploit a click or send you to a download; ClickFix commonly directs you to copy text and run it yourself. That can make a dangerous action feel like routine troubleshooting, especially when the page resembles a trusted service.
#1 Best Overall
The pretext and execution environment can differ. Microsoft documents Windows examples using Run or command-line tools; HHS describes fake browser-update lures; and Google Threat Intelligence documents macOS-targeted instructions as well. Those are variants of the technique, not evidence that every ClickFix campaign uses the same interface or operating system.
How common is ClickFix?
Available figures describe particular organizations’ telemetry, not the share of all cyberattacks worldwide:
- Microsoft’s Digital Defense Report 2025 says ClickFix accounted for 47% of attacks in Microsoft Defender Experts notifications in the last year covered by that report. The figure applies to those notifications, not to all attacks.
- CIS reports that ClickFix made up more than one third of non-malware Albert Network Monitoring and Management alerts in the first half of 2025. That is specific to CIS’s monitoring and alert context.
- In its August 2025 blog, Microsoft reported campaigns targeting thousands of enterprise and end-user devices globally every day. This is Microsoft’s observation at the time of publication, not a current census.
These measurements show why the technique merits attention, but their different datasets and definitions mean they should not be combined into a universal prevalence rate.
How can you avoid a ClickFix attack?
For individuals
- Do not paste and run commands supplied by a webpage, email, pop-up, or chat message unless you have independently verified the request through a trusted channel.
- If a site says you need to verify, update, or fix something, leave the prompt and navigate to the service through its known address or app. Contact support using contact details you already trust rather than the ones in the suspicious message.
- Do not assume a familiar logo, CAPTCHA, or browser-style warning makes the instruction safe. Treat any request to open Run or a terminal as a high-risk action.
For organizations
Microsoft’s Digital Defense Report 2025 recommends layered defenses rather than relying on a single block:
Rank #3
- Train users that pasting commands from unknown sources is as risky as clicking suspicious links.
- Enable PowerShell logging and Constrained Language Mode where appropriate.
- Monitor for unusual clipboard activity followed by shell launches, and correlate those events with downstream execution.
- Harden browsers, including disabling clipboard access and scripting in untrusted browser zones where appropriate.
These controls can improve detection and reduce exposure, but no cited source promises perfect prevention.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if you already ran a command?
If it was a work device, contact your organization’s IT or security team promptly and follow its incident instructions. Until you receive trusted guidance, do not enter credentials or approve additional prompts on the potentially affected device. The exact response depends on what ran and what happened afterward; the cited guidance does not establish one cleanup sequence that is appropriate for every personal device or campaign.
Quick Recap
Best Value
Sources
- Microsoft, “ClickFix social engineering technique expands across cybercriminal ecosystem,” August 21, 2025
- Microsoft Digital Defense Report 2025
- Center for Internet Security, “ClickFix Attacks Are on the Rise: What You Need to Know”
- Google Threat Intelligence Group
- HHS Health Sector Cybersecurity Coordination Center
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
