ClickFix and rogue Quick Assist turn Windows Run into persistence

At a glance

What this is: Blackpoint Cyber’s Threat Pulse describes a ClickFix-style attack chain that used rogue Quick Assist, Windows Run, and attacker-controlled infrastructure to reach host-level persistence.

Why it matters: It matters because social engineering now bypasses traditional boundary controls by weaponising legitimate Windows tooling and user interaction, which changes where defenders need to detect, isolate, and contain risk.

Context

This is a social engineering-led access problem, not a classic exploit chain. The attacker used legitimate remote assistance and Windows execution paths to turn a user action into code execution, which means the control failure sits at the intersection of identity, endpoint trust, and user approval.

For identity and access teams, the relevant question is how much trust is placed in interactive user workflows when those workflows can launch unauthorised code and create persistence. That intersection matters for both human identities and any NHI or remote-access tooling that can be abused as an execution path.

Key questions

Q: What breaks when Windows Run is left enabled in ClickFix-style malware attacks?

A: Leaving Windows Run enabled gives attackers an easy social-engineering path to execute malicious PowerShell locally. In ClickFix-style attacks, the payload can run in memory, bypassing many disk-based detections and reducing browser or antivirus visibility. The safest control is to remove the user interface that the attacker depends on, especially for users who do not need Run for daily work.

Q: Why do legitimate remote-assistance tools increase social engineering risk?

A: They create a trust bridge that attackers can imitate or abuse. If users accept a rogue or unauthorised support session, the attacker gains interactive access inside a live desktop context, which is far more powerful than a simple phishing click because it can enable execution and follow-on staging.

Q: What are the signs that a ClickFix campaign is succeeding before payload execution?

A: Look for unusual use of Run dialog commands, PowerShell download activity, and remote-assistance tools appearing in a user session without a clear support request. Those signals show the lure has moved from persuasion into execution, which is the point where containment should begin.

Q: How should teams respond when a user executes attacker-controlled code on a host?

A: Contain the endpoint immediately, then verify whether persistence, remote access tools, or lateral movement have already been established. The response priority is to stop the session from becoming a foothold, because delayed action turns a single execution event into a broader compromise.

Technical breakdown

How ClickFix turns user action into code execution

ClickFix-style attacks rely on social engineering that persuades the user to copy, paste, or execute a command themselves, often through a familiar interface such as the Windows Run dialog. The security bypass is behavioural, not purely technical: the attacker does not need to defeat authentication if the user becomes the execution mechanism. Once the command runs, the payload can download tools, establish persistence, or stage follow-on activity from attacker-controlled infrastructure. In this pattern, legitimacy is borrowed from the user session and from trusted local utilities, which makes detection harder than with obvious malware delivery.

Practical implication: Treat user-initiated command execution as a high-risk control point and instrument it for immediate alerting.

Why legitimate remote-assist tools create identity and trust gaps

Remote support utilities such as Quick Assist are designed to bridge trust between a helper and a user, but that same trust can be exploited when an attacker imitates support or piggybacks on a rogue session. From an identity perspective, this is not only an authentication problem. It is also a delegation problem, because the user grants implicit execution authority inside a live desktop context. Where organisations allow broad interactive support, they must distinguish sanctioned assistance from unsanctioned remote control and watch for tools that create a false sense of legitimacy around the session.

Practical implication: Restrict remote-assistance paths to approved tools and monitor for unauthorised session delegation or rogue instances.

How persistence and post-execution staging are established

After initial execution, attackers often use PowerShell or similar built-in tooling to fetch second-stage software from infrastructure they control. That move converts a one-time social engineering event into a durable access problem by introducing persistence, potential credential access, and the chance of lateral movement if the session remains active. In this article, Blackpoint says it verified no lateral movement, which suggests containment happened early enough to stop the chain before the attacker could expand. The practical distinction is between a transient execution event and a host compromise that survives the initial lure.

Practical implication: Assume post-execution staging may already be happening when user-launched scripts appear and isolate the host immediately.

Threat narrative

Attacker objective: The attacker aimed to gain remote access, install additional tooling, and preserve foothold on the host for follow-on activity.

1. Entry began when the user was tricked through ClickFix-style social engineering into using the Windows Run dialog and a rogue Quick Assist instance.
2. Credential or execution abuse followed as the command launched PowerShell to download and install a backup application from attacker-controlled infrastructure.
3. Impact was contained at the host boundary because the SOC isolated the device before the attacker could establish broader persistence or lateral movement.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ClickFix is a governance problem before it is a malware problem: the core weakness is the assumption that a user can safely distinguish legitimate support or remediation prompts from attacker-directed execution. Once a user is convinced to launch a command, the security stack has already lost the first control boundary. The operational lesson is that user-mediated execution must be treated as an access control event, not just an awareness issue.

Legitimate remote-assist tools create a trust gap that conventional endpoint policy often underestimates: Quick Assist-like workflows collapse the distance between helpdesk access and attacker access when the session origin is not strongly verified. That is especially relevant where identity governance is focused on accounts and not on the legitimacy of the live assistance channel. Organisations need a control model that treats remote support sessions as privileged pathways.

Execution-path abuse: the named concept here is the use of trusted local interfaces such as Run dialog prompts to convert social engineering into code execution. This pattern matters because it bypasses many perimeter assumptions and creates a fast route from user interaction to persistence. Practitioners should recognise this as a distinct failure mode in endpoint governance, not as a generic phishing variant.

Early isolation is the decisive response when initial execution succeeds: Blackpoint’s account shows that cutting off the device can prevent persistence and lateral movement before the attacker converts one successful prompt into a broader incident. That makes containment speed more important than post-hoc investigation alone. For security teams, the takeaway is that response playbooks need a host-isolation trigger tied to suspicious user-launched execution.

Machine-to-human trust boundaries are now part of identity security: ClickFix campaigns exploit the space where human judgment, remote support, and endpoint execution overlap. That means identity governance cannot stop at authentication strength or access reviews. It has to account for how trust is delegated during live sessions, especially when those sessions can invoke tooling that behaves like a temporary NHI or operator proxy.

What this signals

ClickFix-style abuse is becoming a durable access pattern, not an edge-case lure: when a campaign can convert ordinary user interaction into code execution, defenders need to shift more control to the point of execution and less to post-event review. The practical challenge is to detect trust abuse while it is still a session problem, not after it becomes persistence.

Execution-path abuse: this is the governance gap that matters most here. Teams often secure accounts and endpoints separately, yet this pattern exploits the handoff between the human decision to run something and the system’s willingness to execute it. That makes session-level containment and local command telemetry central to response.

Blackpoint Cyber’s account also shows why incident response speed matters as much as initial detection. The SOC isolated the device and checked for persistence before the attacker could expand access, which is the right control posture when legitimate tools are being used as an attack path.

For practitioners

• Harden user-launched execution paths Block or alert on suspicious use of the Windows Run dialog, scripted PowerShell downloads, and other user-initiated command paths that commonly appear in ClickFix-style campaigns.
• Constrain remote-assistance trust Allow only approved remote support tooling and require strong verification for any session that could provide interactive desktop control or support escalation.
• Isolate hosts at first malicious execution Trigger immediate device isolation when a user session launches attacker-like commands or pulls binaries from untrusted infrastructure, before persistence can take hold.
• Tune detection for legitimate-tool abuse Create detections for Quick Assist misuse, PowerShell fetch-and-execute behaviour, and abnormal post-interaction activity that suggests a lure has converted into execution.

Key takeaways

• ClickFix-style campaigns exploit legitimate user workflows to turn a normal desktop action into remote execution and host-level access.
• Blackpoint Cyber reports more than 470 confirmed ClickFix-style attacks over 90 days and says they accounted for 32% of total incidents in that period.
• The most effective control response is rapid containment at the host boundary, paired with detections for user-launched execution and unauthorised remote-assistance use.

Key terms

• ClickFix-Style Attack: A ClickFix-style attack uses social engineering to persuade a user to copy and paste malicious content into a browser or application workflow. The danger is not the prompt alone but the execution path it triggers, which can bypass traditional email and login controls.
• Remote-Assistance Abuse: Remote-assistance abuse occurs when legitimate support software is used to obtain unauthorised access or to make malicious activity look like approved helpdesk activity. The risk is not the tool itself, but the trust it inherits from normal support workflows and user expectations.
• Execution-Path Exposure: Execution-path exposure is the risk that a credential or sensitive action becomes dangerous because it is used inside an attacker-influenced workflow. The secret may be valid, but the path it takes can still hand control to an adversary. This is a runtime identity problem, not only a storage problem.
• Host Isolation: Host isolation is the temporary restriction of a device’s network access so it can be contained during an investigation or active incident. Defenders use it to stop lateral movement, limit data loss, and preserve evidence while keeping enough management access to remediate and collect telemetry.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, human identity, identity lifecycle, and secrets management. It is designed for practitioners who need to connect identity governance to real operational risk across modern security programmes.