Sixfold surge of ClickFix attacks threatens corporate defenses – Source: www.csoonline.com

Incidents of ClickFix — the social engineering attack technique that tricks users into executing malicious code — are skyrocketing.

ClickFix attacks typically involve displaying a fake error or counterfeit CAPTCHA verification with the intent of tricking a prospective victim into copying, pasting, and executing malicious commands on their devices.

Attacks typically begin after a user visits a compromised or malicious website, or opens a deceptive attachment or link. Victims are socially engineered into solving a malicious challenge, leading to the execution of PowerShell code, followed by additional payloads.

The attack vector affects all major operating systems, including Windows, Linux, and macOS.

Security vendor ESET reports that ClickFix attacks rose by more than 500% between December 2024 through to May 2025 compared to the previous six months. ClickFix is now the second most common attack vector after phishing and was responsible for nearly 8% of all attacks blocked by ESET in H1 2025.

“The list of threats that ClickFix attacks lead to is growing by the day, including infostealers, ransomware, remote access trojans, cryptominers, post-exploitation tools, and even custom malware from nation-state-aligned threat actors,” according to Jiří Kropáč, director of Threat Prevention Labs at ESET.

ClickFix has quickly become one of the most prominent cybercriminal intrusion vectors because it is less understood than phishing, which users have become progressively more wary about over time, and frequently successful.

“What makes this new social engineering technique effective is that it is simple enough for the victim to follow the instructions, believable enough to look like it might fix a made-up problem, and abuses the probability that victims won’t pay much attention to the exact commands they have been asked to paste and execute on their device,” Kropáč explained.

Kropáč added: “With its growing popularity, it is possible that Microsoft and Apple, but also the open-source community, will add some kind of security warning like the one used for macros in Word or Excel, or for files copied from the internet, notifying users that they are about to execute a potentially dangerous script.”

Dangerous payloads

ClickFix tactics have fueled the surge in malware such as Lumma and SectopRAT, using trusted tools like MSHTA to bypass defenses and deliver payloads, according to threat intel firm ReliaQuest.

Social engineering tactics like IT help-desk impersonation has pushed RDP (Remote Desktop Protocol) ahead of internal spearphishing as the top initial access method, threat intel firm ReliaQuest reports.

Security vendor SentinelLabs warns that ClickFix shows how threat actors are taking advantage of the inconvenience of repetitive anti-spam verification processes to expand their playbook.

Countermeasures

ClickFix attacks often bypass many security tools because the approach relies on user interaction. Training users to recognize suspicious prompts and avoid copying and running code from untrusted sources is a critical first step in defending against the growing threat.

Tightening up technical controls such as endpoint protection, web filtering, and email security technologies to block access to known malicious sites and attachments can further mitigate attacks. Incident response planning also needs to be improved. Tightening up organizational PowerShell policies is another way to combat the threat.

ESET told CSO: “Users should also remain vigilant whenever anyone is offering ‘one-click’ or ‘copy-and-paste’ fixes to unknown issues. In corporate environments, endpoint detection and response (EDR) tools can flag anomalous PowerShell usage — especially on machines that rarely need it — and thus improve visibility into and protection against such attacks.”