ClickFix attacks: are your controls keeping up?

TL;DR: ClickFix attacks work by turning a fake error or verification prompt into a step-by-step instruction to open Run, PowerShell, or Terminal and execute an obfuscated command, according to ThreatLocker. That makes user judgment an unreliable last line of defence, and containment has to start at execution control, least privilege, and script restriction.

Editorial analysis by NHI Mgmt Group, based on content published by ThreatLocker: “Why ClickFix is so effective against security-aware users”.

Key questions

Q: What breaks when users are tricked into running commands from a web page?

A: Browser trust and download controls break first, because the attacker shifts execution from the browser into the local shell.

Q: Why do fake CAPTCHA prompts and browser errors lead to compromise?

A: They work because they mimic normal troubleshooting behaviour and make the malicious action feel like the cautious choice.

Q: What are the signs that a ClickFix campaign is being used against users?

A: Common signs include fake browser errors, CAPTCHA or verification prompts, instructions to open PowerShell or the Windows Run dialog, and HTML attachments that claim to fix a document or software issue.

Practitioner guidance

• Block web-driven command execution paths Prevent pages from instructing users to open Run, PowerShell, Command Prompt, or Terminal as part of normal web verification or support workflows.
• Apply deny-by-default controls to high-risk scripts Use application allowlisting and script restrictions so newly downloaded or obfuscated code cannot execute just because the user launched it.
• Contain PowerShell and native utilities Restrict what approved tools can access, launch, modify, and connect to so legitimate system binaries cannot freely fetch payloads or spawn suspicious child processes.

Bottom line: ClickFix succeeds by converting a user’s desire to verify or fix a problem into a direct command execution path on the endpoint.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →