ClickFix

ClickFix is a social-engineering execution technique in which a web page, advertisement or document presents the visitor with a problem it claims is theirs to solve — a human-verification check that will not complete, a browser that cannot render the page, a document that will not open, a Mac that is "low on storage" — and then offers the remedy as a command the user copies and pastes into a system interface they already trust: the Windows Run dialog, PowerShell, Windows Terminal, the macOS Terminal, or the browser's address bar. The victim executes the attacker's code themselves, as an authenticated interactive user, inside a native signed binary that is present on every system, which is precisely the profile of legitimate administrative work. There is no vulnerability for a scanner to find, no attachment for a mail gateway to detonate and no downloaded file for browser reputation scoring to evaluate, so the technique sidesteps the controls most organisations rely on rather than defeating them.

MITRE gave the behaviour its own ATT&CK sub-technique — T1204.004 (User Execution: Malicious Copy and Paste) — on 18 March 2025, covering Windows, macOS and Linux, and named ClickFix in the technique description itself. By the second half of 2026 it is no longer a curiosity on the edge of the threat landscape: Microsoft attributed 47% of the initial-access cases its Defender Experts team handled in 2025 to ClickFix, ahead of conventional phishing, and CTM360's September 2026 census traced roughly 17,000 infected URLs serving fake Cloudflare verification pages. The operational conclusion CTM360 draws — that blocking lure domains is close to worthless as a control — is the one that should change defensive posture.

At a glance

How the technique works

1 — A pretext the user believes is theirs to solve

The lure imitates a routine interruption rather than a threat: a Cloudflare "Performing security verification" check, a browser-render or document-open failure, a software-update prompt, or a macOS disk-space "maintenance" page styled as an Apple support article. CTM360's taxonomy records distinct Windows and macOS template families, and the pretext set is deliberately mundane so that it matches something the visitor may genuinely be experiencing.

2 — Clipboard injection instead of a download

JavaScript on the page writes the "fix" — actually a command — directly to the clipboard and instructs the visitor to paste it. Nothing is downloaded at the point of contact, so there is no file path, no download event and no installer for the user or their tooling to notice.

3 — The user executes it

Instructions direct the visitor to the platform's own command surface: Windows Run dialog (the canonical form), PowerShell or Windows Terminal (the TerminalFix variant), macOS Terminal, or the browser's address bar. The pasted command is usually obfuscated — Base64 is the common case — so its intent is not visible on screen. Observed shapes include curl | zsh on macOS and iwr | iex (Invoke-WebRequest piped to Invoke-Expression) on Windows.

4 — Staging, execution and payload

The command fetches a second-stage script from attacker infrastructure — frequently fronted by a legitimate cloud service — which then retrieves the final payload. In the dropper CTM360 recovered from a live compromised host, a machine fingerprint (machine GUID, volume serial number, computer name, BIOS manufacturer, system model, GPU and username) is Base64-encoded into the download path, so the command-and-control server sees the victim's identity before it serves anything and can return a payload chosen per machine, or nothing at all.

5 — Server-side targeting and analysis resistance

The lure page reports the visitor's operating system and version back to the operator, which replies with a configuration naming which platforms to attack and which landing page each receives. In CTM360's sample, Windows was enabled while the macOS and Linux branches were built, functional and held in reserve, mobile was suppressed entirely and a cookie suppressed the overlay for repeat visitors for 90 days. A traffic distribution system polls the operator roughly every 1.5 seconds and can silently mark a session "verified" without ever showing the malicious instruction, so researchers, sandboxes and crawlers receive a clean page while intended targets receive the lure.

Variants and naming

MITRE ATT&CK mapping

Scale and tempo

Notable incidents

ClickFix is now a recurring delivery layer rather than a one-off campaign, so the wiki's coverage sits across many incident pages. The entries below are the ones that moved the technique forward.

Why the technique works

Three properties explain the persistence, and none of them is a technical flaw a vendor can patch.

It targets the trust boundary that remains after everything else is hardened. No exploit is used, so vulnerability management is not engaged; no attachment is delivered, so mail gateway detonation and sandboxing are not engaged; no file is written at the point of contact, so download reputation and executable allowlisting are not engaged. The command arrives as text on the clipboard and is executed by a signed, present-on-every-system binary at the direction of an authenticated user — the same activity profile as legitimate administrative work, which is why signature-based and behaviour-based detection both struggle.

The economics favour it. Compromising a small website is cheap, and CTM360's census found operators holding macOS and Linux branches in reserve behind a server-side flag — so the return comes from conversion rate rather than engineering effort. That combination is why the technique survives takedowns: the static indicators defenders block are the ones the operator can change fastest. CTM360 observed a single smart contract returning three different lure hosts in one day of analysis while not one compromised site was modified.

It is a configuration problem, not a Windows problem. The received wisdom that ClickFix is a Windows issue describes the current operator settings rather than the capability: CTM360's sample had macOS and Linux branches built and functional, mobile suppressed and repeat visitors suppressed for 90 days, all changeable with one flag. Treating it as a Windows-only risk understates the exposure of macOS fleets, which the PasteSwitch operation had already demonstrated in production.

Detection

• Process lineage from the user's own interface. Alert on interactive interpreters (powershell.exe, pwsh.exe, cmd.exe, wscript.exe, mshta.exe, rundll32.exe) descending from explorer.exe or a browser process rather than from a service, login script or management tool.
• Command-line content. Base64 or long concatenated string payloads in PowerShell script blocks; Invoke-WebRequest or curl piped to an interpreter; WebDAV UNC paths passed to rundll32.
• Script telemetry. PowerShell script block logging, module logging and the Antimalware Scan Interface are the highest-value Windows sources, and they are exactly what Windows chains in this family attempt to disable — so an AMSI or logging configuration change on an endpoint is itself a detection.
• macOS. Shell command history and process accounting for curl piped to a shell, and for interpreters spawned by Terminal or from the browser's downloading context; MacSync activity appeared as ordinary interactive Terminal sessions.
• Network. Egress to smart-contract RPC endpoint pools, non-web UDP WebRTC traffic, and staged retrievals fronted by public cloud services, Google Sheets or public APIs. Note that C2 resolution through Telegram channel descriptions and Steam profiles means the network artefact may be a legitimate service name in TLS SNI.
• What not to rely on. Clipboard writes from page JavaScript are not observable at the endpoint, and lure domains rotate faster than blocklists can be published.

Defensive countermeasures (ATT&CK → D3FEND)

Australian and New Zealand relevance

ClickFix is not an Australia-specific threat, but its delivery channels reach Australian and New Zealand organisations directly. The Brevo supply-chain injection ran through a marketing platform whose forms, chat widgets and SDK loaders are embedded across small-business and SMB websites, which is the same population of self-managed WordPress and PrestaShop hosting that the Netskope campaign compromised at scale — a hosting profile common across both countries. The lures themselves are training-resistant by design, because they ask the user to do something that feels like troubleshooting rather than something that looks like a security decision, and the single rule that carries most of the value for staff does not decay when the artwork changes: no legitimate website, verification check, error message or software update will ever ask you to copy something and paste it into the Run box, PowerShell, Terminal or a File Explorer address bar.

Two structural points belong in Australian planning. First, the September 2026 abuse of the third-party.com documentation placeholder domain places the lure inside developer documentation, repositories and AI tool descriptors — material that automated agents now read and follow, which is a supply-chain exposure for engineering teams rather than an end-user one. Second, the technique's economics mean the population most exposed is the one with the least defensive depth: small hosting providers and self-managed web estates, which are also the least likely to have an incident-response capability when the lure converts.

Related pages

• Over 5 400 Hacked Sites Serve Clickfix Payloads Stored On The Blockchain — on-chain delivery at scale
• Brevo Supply Chain Attack Injected Clickfix Scripts On Up To 100 000 Customer Si — the largest single reach recorded in the wiki
• Terminalfix Uses Fake Cloudflare Captchas To Deploy Reverse Tunnel Backdoor — the Terminal-targeting variant
• Clickfix Is Now The Leading Enterprise Initial Access Technique And 17 000 Urls — the CTM360 census
• Hbo Max Reddit Account Hijacked For 108 Pasteswitch Clickfix Advertisements — proven macOS branch in the wild
• Scmbanker — criminal toolkit distributed by ClickFix lure
• Microsoft Ties 30 Rotating Domains To Macsync Stealer Infrastructure — macOS stealer staging
• Mitre Attack — the framework in which T1204.004 sits
• D3Fend — the countermeasure framework used above