ClickFix social engineering: what practitioners need to act on

TL;DR: ClickFix evolved into the most prevalent initial access method in 2025, accounting for 47% of observed attacks, according to Todyl, as threat actors refined copy-paste lures, fake verification pages, and cross-platform delivery to bypass traditional controls. Human-assisted execution now outpaces many technical defenses, so governance must move to trust validation at the point of action.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “ClickFix: The Evolution of Copy-Paste Social Engineering”.

By the numbers:

• ClickFix represented 47% of observed attacks in Microsoft's 2025 Digital Defense Report.

Key questions

Q: What breaks when users are tricked into running commands from a web page?

A: Browser trust and download controls break first, because the attacker shifts execution from the browser into the local shell.

Q: Why do fake verification pages work so well against users?

A: They work because verification flows already ask users to provide sensitive information, so the attack feels normal.

Q: What are the signs that copy-paste social engineering is succeeding?

A: Look for unusual use of native execution paths, especially pasted PowerShell or command-line content, suspicious RunMRU entries, mshta or rundll32 execution, and browser activity that precedes local code execution.

Practitioner guidance

• Harden manual execution workflows Flag unexpected use of Run dialog, terminal, File Explorer address bar, and clipboard-pasted commands as high-risk user actions, especially when they originate from verification or activation pages.
• Train users on fake verification lures Teach staff to treat CAPTCHA checks, update prompts, activation screens, and recovery dialogs as suspicious when they ask for pasted commands or copied tokens.
• Instrument for command-line and registry evidence Collect telemetry for PowerShell, rundll32.exe, mshta, and RunMRU changes so analysts can identify copy-paste execution chains and reconstruct what the user ran.

Bottom line: ClickFix is effective because it turns trusted user actions into the delivery mechanism for malicious code.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →