You visit the website of a local business to check its opening hours. But first, you need to prove you’re not a robot. A familiar CAPTCHA screen appears. The logo looks legitimate, the design is convincing. After ticking the checkbox, however, you’re instructed to press Windows + R, then Ctrl + V, and finally Enter. Before you know it, you’ve executed a malicious script on your computer.

This is ClickFix.

What was still a relatively uncommon technique a few years ago is now appearing with increasing frequency in security incidents. At the Jarviss Security Operations Center (SOC), we’ve also observed a rise in social engineering attacks that abuse legitimate websites and trusted user interactions such as CAPTCHA verifications. The insights we gain from these incidents are shared with our customers to help them stay informed about relevant developments in today’s threat landscape.

How It Works

When the webpage loads, JavaScript silently copies a PowerShell command to the user’s clipboard. The website itself is often legitimate, but has been compromised through an injected external script that displays the fake CAPTCHA. The domain is correct, and the SSL certificate is valid, making the page appear trustworthy.

The copied command downloads a second-stage payload from an external server and executes it directly in memory, without writing anything to disk. Typical payloads include information stealers such as Lumma, AMOS, or MacSync, which target browser cookies, saved passwords, and session tokens.

Security software will often detect this activity, but may not immediately intervene because the user initiated the execution themselves. From an Endpoint Detection and Response (EDR) perspective, it appears as though someone simply opened PowerShell. Given enough indicators of malicious behavior, the EDR solution will usually respond, but by then the malware may already have had 10 to 20 seconds to harvest credentials or establish persistence.

What You Can Do Today to Protect Against ClickFix

Technical Controls

The challenge with ClickFix is that many security controls are designed to detect suspicious files or unauthorized code execution. With ClickFix, however, the user initiates the execution, shifting the focus from malware detection to identifying and limiting the abuse of legitimate system tools.

A good first step is to review which scripting tools are actually required within your organization. On Windows, utilities such as PowerShell, mshta, and Windows Script Host are often widely available, even though only a small group of users genuinely needs them. The same applies to Terminal and AppleScript (via osascript) on macOS. The smaller the attack surface, the lower the chance that an attack will succeed if a user follows the malicious instructions.

It’s equally important to apply the principle of least privilege. Users should not have local administrator rights unless these are required for their role. If a user with limited privileges executes a ClickFix command, the impact of a compromise is often significantly reduced, as the attacker has fewer opportunities to install software, modify system settings, or establish persistence.

User Awareness

When it comes to security awareness, keeping the message simple is often the most effective approach. Users don’t need to understand how PowerShell or AppleScript works. They only need to remember one rule:

No legitimate website will ever ask you to paste a command into Run, PowerShell, Terminal, or any other system window.

In practice, this single piece of advice is often more effective than a detailed technical explanation.

The first few minutes after executing a ClickFix command often determine whether an attacker gains access only to an endpoint or also manages to steal session tokens, browser cookies, and cloud account credentials. Users should therefore be encouraged to report incidents immediately even if they have already followed the instructions.

EDR solutions frequently block these scripts before any data can be exfiltrated. However, a prompt report can make all the difference if the EDR solution fails to intervene or does not detect the attack. Ultimately, user awareness remains one of the strongest defenses. Well-informed users are more likely to recognize suspicious situations and report them before an attack succeeds.

Contributing to a Safer Internet

Whenever we identify compromised websites distributing ClickFix content, we contact the website owners whenever possible to notify them of the compromise. In many cases, these organizations are completely unaware that their website is being abused. By informing them, we help limit the further spread of these attacks and contribute, in our own way, to the fight against cybercrime.

Author: Louis Hertleer