ClickFix attacks: how they work & how to block them

A ClickFix attack tricks users into copying and executing malicious commands by displaying a fake error message, CAPTCHA verification, or troubleshooting prompt in the browser. The page loads a malicious payload (typically PowerShell or mshta commands) onto the clipboard and instructs the user to paste it into the Windows Run dialog or terminal. The user believes they're fixing a problem; they're actually executing malware.

The technique exploits user trust in familiar UI patterns — CAPTCHAs, error messages, install instructions. The growing list of variants includes CrashFix (fake crash pages), ConsentFix (combining clipboard hijacking with OAuth consent abuse), and InstallFix (fake software installation pages).

There are two stages where ClickFix can be detected — in the browser where the social engineering and clipboard hijacking happen, and at the endpoint where the malicious command executes.

Browser-layer detection is the earliest interception point because it sees the fake CAPTCHA or error page and the clipboard manipulation before the user acts. Endpoint detection is the fallback — EDR can potentially catch the malicious command execution after the user pastes it, but the payload is already running, and because the command is user-executed rather than launched by a program it can evade behavioral detections that expect malicious process chains.

The endpoint layer is also absent for a significant portion of the workforce. Contractors, BYOD users, and developers often operate with EDR tuned down or missing entirely, making browser-layer detection the only control that reliably covers these populations.

Several commonly recommended mitigations have practical limitations:

• Disabling the Run dialog via GPO — blocks the Win+R paste path but doesn't cover terminal windows, PowerShell directly, or macOS users. Also breaks legitimate workflows.
• Blocking PowerShell for standard users — reduces one execution path but ClickFix payloads also use mshta, curl, and other living-off-the-land binaries. Attackers adapt the payload to whatever is available.
• Restricting clipboard access — blanket clipboard restrictions are operationally impractical for most organizations. ClickFix doesn't require any special clipboard permissions; it uses standard JavaScript clipboard APIs.
• Email security — misses most ClickFix because the majority (4 in 5) payloads arrive via malvertising and search engines, not email.
• Security awareness training — ClickFix lures mimic routine interactions (CAPTCHAs, error messages, install instructions) that users encounter daily, making them harder to distinguish from legitimate prompts than traditional phishing.

Push provides two-stage ClickFix detection: it identifies the ClickFix page behavior (fake CAPTCHAs, fake error messages, fake install pages) and analyzes clipboard contents for malicious commands. This detection is technique-class — it covers ClickFix, CrashFix, ConsentFix, InstallFix, and future variants that use the same clipboard-injection mechanic.

A tool that operates inside the browser and can detect both the social engineering page and the malicious clipboard payload. Email security sees the lure only if it arrives by email, and since 4 in 5 ClickFix attacks detected by Push are delivered via search engine, this is a significant gap. SWGs see the URL but can't inspect rendered page behavior or clipboard contents. EDR can detect malware execution after the user pastes the command, but the payload is already running by that point, and if undetected, the final line of defense pre-compromise has been bypassed.

Push detects ClickFix inside the browser by identifying the page behavior patterns and analyzing clipboard contents for malicious commands. See why EDR misses ClickFix.

EDR and antivirus can potentially detect the malware execution after the user pastes and runs the command — but they don't see the browser-side delivery at all. The ClickFix page, fake CAPTCHA, clipboard hijacking, and social engineering all happen inside the browser session, invisible to endpoint tools. The attack also doesn't drop a file or exploit a vulnerability — the user voluntarily pastes a command, which looks like legitimate user behavior from the endpoint's perspective.

Push catches ClickFix at the source — in the browser, before the clipboard payload is executed. EDR serves as the safety net for anything that gets past. Read why EDR misses browser-based attacks.

The most common form of ClickFix. The attacker creates a page mimicking a legitimate CAPTCHA verification ("Verify you are human") that silently loads malicious commands onto the clipboard. The page instructs the user to press Win+R and paste — supposedly to complete verification, but actually to execute malware. The payloads commonly deliver infostealers, RATs, or other malware.

These attacks are effective because CAPTCHAs are routine — users follow the instructions without suspicion. Push detects fake CAPTCHA attacks by identifying the combination of CAPTCHA-like visual elements with clipboard manipulation, in the browser in real time — before the victim tries to paste and run the malicious command.

The page displays a fake CAPTCHA, error message, or installation prompt, then silently loads malicious commands (usually PowerShell) onto the clipboard. Instructions tell the user to press Win+R, paste, and press Enter — framed as a fix, verification step, or install procedure. The clipboard manipulation is invisible to the user.

The technique exploits trusted patterns. Users encounter CAPTCHAs daily and follow verification instructions reflexively. Fake error messages trigger troubleshooting instincts. Fake install pages (aka. InstallFix) leverage the normalization of command-line installation workflows among developers.

All variants share the same core mechanic — silently loading malicious content onto the clipboard and instructing the user to paste and execute it. The names describe the social engineering wrapper used to make the paste action feel routine:

• ClickFix — fake CAPTCHAs, verification prompts, or "prove you're human" challenges. The most common variant and the one that established the technique.
• FileFix — fake file preview pages (PDFs, documents, images) that claim the file can't render and prompt the user to paste a command to "repair" or "download" it.
• CrashFix — fake browser or application crash pages that instruct the user to paste a "fix" command.
• InstallFix — cloned installation pages for legitimate developer and AI tools (Claude Code, Homebrew, VS Code extensions) that deliver infostealers via "paste this to install" workflows.
• ConsentFix — combines clipboard injection with OAuth consent abuse, exploiting the Azure CLI's localhost redirect to achieve MFA bypass without proxying credentials. Unlike the other variants, ConsentFix is fully browser-native — there is no malware execution or endpoint component. The user is tricked into copy-and-pasting a legitimate URL containing OAuth material into the attacker’s page to complete the attack.

The technical mechanism is consistent across all variants — the distinction is in the social engineering pretext and, in ConsentFix's case, an entirely browser-native attack chain that eliminates the endpoint detection surface. Push detects the underlying technique at the page and clipboard-injection level, covering all current and future variants regardless of the lure.

The most common recommendation is to restrict clipboard access at the browser or endpoint level, but blanket clipboard blocking is operationally disruptive — copy and paste is fundamental to how people work, and broad restrictions generate friction and workarounds without distinguishing between legitimate use and malicious injection. Enterprise browsers that offer clipboard controls typically apply them as a DLP measure (blocking paste into certain apps) rather than detecting when a web page writes malicious content to the clipboard, which is the actual ClickFix mechanic.

The effective approach is monitoring what web pages write to the clipboard and intervening only when the content is malicious. Network and endpoint tools don't have visibility into browser clipboard operations — the clipboard manipulation happens entirely within the browser's JavaScript execution context.

Push detects when a page writes malicious commands to the clipboard (PowerShell, mshta, curl indicators) and can block or warn in real time. Clipboard blocking is scoped to malicious actions, not blanket copy/paste restriction, meaning legitimate clipboard use is unaffected.

Push also supports configurable regex-based clipboard rules for detecting sensitive data patterns being pasted into unauthorized applications, giving security teams DLP-style clipboard controls without the blunt instrument of blocking all clipboard activity.

No. SWGs inspect web traffic at the network or proxy layer — they see URLs, domains, and traffic metadata. They cannot inspect rendered page behavior, DOM manipulation, or clipboard operations inside the browser session. A ClickFix page looks like normal HTTPS traffic; the malicious behavior happens in JavaScript after rendering.

SWGs can block known-bad domains, but ClickFix commonly uses legitimate or freshly registered domains. Push operates inside the browser where the attack plays out — detecting the page behavior and clipboard payload at the point of execution.

ClickFix has become a general-purpose delivery mechanism used by financially motivated criminals and nation-state groups alike. The most common payloads are:

• Infostealers — the dominant payload category. Lumma Stealer is the most frequently observed, alongside StealC, Rhadamanthys, DanaBot, SnakeStealer, and AMOS/Atomic Stealer (targeting macOS). These harvest browser-stored credentials, session cookies, cryptocurrency wallets, and saved passwords.
• Remote access trojans (RATs) — NetSupport RAT, AsyncRAT, VenomRAT, XWorm, and Quasar RAT provide persistent remote access to compromised machines.
• Loaders and backdoors — Latrodectus, DarkGate, and GolangGhost serve as intermediate stages that download additional payloads or establish persistent backdoors.

The infostealer connection is particularly significant because stolen session cookies enable session hijacking and stolen credentials feed credential stuffing campaigns — creating a direct chain from ClickFix to downstream account takeover that can play out weeks or months later.

Push catches ClickFix at the delivery stage, before the payload executes — detecting the page behavior and malicious clipboard content inside the browser.