The technical controls that stop a ClickFix

Sponsored by

Your AI strategy has a security problem: 43% of IT leaders now cite security concerns as the top barrier to expanding AI agent deployment, according to research from JumpCloud. Before giving agents more access to apps, data, and workflows, make sure you can govern the identities behind them. See how to secure every identity, human or not.

Why go through all the trouble of executing malicious malware yourself when you can just get the victim to do it for you?

Tech and security companies have seen increases in ClickFix attacks: social-engineering lures that lead users to copy-and-paste malicious code, and essentially hack themselves. The ClickFix could include ruses like fake CAPTCHAs, error messages, and software installation prompts.

Telemetry from cybersecurity company ESET found that ClickFix detections more than doubled between H2 2025 and H1 2026. Microsoft noted this upward trend beginning in 2024, followed by “widespread adoption” of the tactic in 2025, according to its own report. That Microsoft study also found that ClickFix led initial access methods for cyberattacker intrusions, followed by phishing, password-spray attacks, SEO poisoning, and vulnerabilities.

And in September, multiple reports (including research from cybersecurity company ADAMnetworks and infostealer intelligence firm Hudson Rock) revealed that fake HBO Max ads, posted on Reddit, linked readers to lookalike pages. Directions on these phony pages asked users to add malicious commands into macOS Terminal to install software holding infostealing malware. A Windows version of the attack involved commands to PowerShell and built-in Microsoft utilities.

As a certified instructor (and author) at cybersecurity training provider SANS Institute, Ryan Chapman covers ClickFix attacks and defenses in his classes. In 2024, he had a hard time believing the topic belonged on the curriculum long-term, and that users would actually copy-and-paste malicious commands on their own. But once ClickFixing threat actors turned to CAPTCHAs—a mechanism that has always asked users to do something odd to verify they’re human—he saw the tactic as a more impactful one.

“I work on a threat hunting team. We can’t go a single day, not one day, without running into ClickFix attacks of some sort,” Chapman said.

While the obvious takeaway for the IT pro is employee awareness (“Don’t trust every CAPTCHA!”), there are tech controls that can let IT pros know when their employees are ClickFixing.

For Windows. On Windows, a ClickFix often begins with a user hitting Win+R, which opens the Run dialog. The malicious page may load a malicious script to a user’s clipboard; social engineering may lead a target to paste the code into the terminal.

IT-controlled (i.e., managed) browsers have settings to block a site’s access to the Clipboard function, Chapman told us.

Windows Group policy settings also allow admins to disable run commands from the Start menu or taskbar, as well as the shortcut “hotkey” combinations.

In an email to IT Brew, Ensar Seker, CISO at SOCRadar, recommended that IT pros force untrusted PowerShell actions into Constrained Language Mode, where commands like downloads can be blocked. For higher-risk user populations, Seker also advised security teams to use Microsoft’s security feature App Control for Business; enabling a “BlockScriptOnPolicyFailure” command rejects scripts not explicitly approved.

According to Seker, additional attack surface reduction rules, available in Microsoft Defender environments, include:

• Block execution of potentially obfuscated scripts
• Block executable files from running unless they meet a prevalence, age, or trusted-list criterion
• Block JavaScript or VBScript from launching downloaded executable content

PowerShell also supports logging.

What about Macs? Seker recommends organizations use mobile device management (MDM) to restrict Terminal and scripting tools for users who do not need them. Endpoint security tools, he added, should alert when a browser launches Terminal or a shell, along with suspicious scripts and command execution; web filtering, too, can block known malicious infrastructure.

“The key control is to prevent a socially engineered command pasted into Terminal from becoming unrestricted code execution, while maintaining visibility into the browser, Terminal, shell, and resulting child processes,” he wrote to IT Brew.

What’s next? Chapman envisions ClickFixing threat actors finding creative scenarios beyond the CAPTCHA that trick users into copying and pasting malicious commands—like enabling (or disabling) a new AI feature, he envisioned off the cuff. His class still seems relevant for the time being.

“This is not a fad. ClickFix is going nowhere. There are so many different variants of it, so many really strong, convincing implementations of it, and they keep coming up with new commands and methodologies to bypass security mechanisms and products,” he said.