ClickFix attacks use fake verification, browser error or CAPTCHA prompts to persuade users to open local tools and execute pasted commands. The user believes they are fixing a problem, but the command often launches malware or exposes sensitive data. The core defence is to stop any web flow that asks for system-level execution outside normal business use.
How the fake verification prompt works
ClickFix depends on trust, not technical exploitation. The lure is usually a browser page that looks like a verification step, CAPTCHA, or error fix, and it pushes the user to open a local tool and paste in a command. That framing turns a malicious action into something that feels routine and self-service, which is why the tactic works so well.
The prompt often borrows the language of access recovery, browser security, or content checks so the user thinks the request is temporary and harmless. A malicious command can be made to look like a normal troubleshooting step, especially when it is presented as the fastest way to restore a page, unlock content, or clear an error state.
Because the tactic relies on user execution, the social engineering quality of the prompt matters more than the payload itself. Well-designed lures reduce hesitation by making the user believe they are interacting with the system owner, the browser, or a legitimate service provider.
What makes users comply with the paste-and-run step?
The central manipulation is urgency plus legitimacy. The user is told that something is broken, blocked, or under review, then given a simple action that appears to resolve it immediately. That combination lowers scrutiny because the user is focused on restoring access rather than evaluating the command.
ClickFix also exploits the fact that many users have been trained to follow browser prompts without questioning them. If the page looks familiar enough, the pasted command can feel like part of a standard support workflow rather than a request to execute code.
Attackers benefit when the command is described as a copy-and-paste fix, because users tend to treat pasted text as already vetted. That mental shortcut is exactly what the attack depends on: the user becomes the execution path.
Why the payload is dangerous once it is pasted
Once the command runs, the attacker can use the local environment to launch malware, steal data, or establish follow-on access. The immediate effect is often less important than the access the command creates, since the real goal may be credential theft, session theft, or a foothold for later activity.
In practice, the command may open a downloader, run script content, or trigger another trusted system tool in a way that bypasses normal browser defenses. The user believes they are fixing a problem, but the command can expose sensitive data or hand control to the attacker.
The risk is especially high when the pasted command is allowed to touch authentication material, browser data, or enterprise endpoints. Once the user executes it, the incident often shifts from phishing into full host compromise.
Risk and Threat Considerations
ClickFix is dangerous because it converts a browser-side deception into local execution, which means a single successful lure can lead to malware installation, session theft, or broader compromise. The attacker does not need to break a security control if the user is persuaded to run the code for them.
Failure mechanism: The victim trusts a fake verification or troubleshooting flow, then executes attacker-controlled commands in a local tool where normal web protections no longer apply.
Impact: This can lead to malware execution, data exposure, stolen sessions or credentials, and a foothold for lateral movement if the host is connected to enterprise resources.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204 — User Execution | ClickFix relies on the victim executing attacker-supplied commands. |
| Recommendation — Map paste-and-run lures to T1204 and block user-driven execution paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Stolen sessions or credentials from ClickFix often turn into account abuse. |
| Recommendation — Tighten account monitoring and revoke exposed access quickly. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Fake error and verification prompts exploit trust in browser error states. |
| Recommendation — Ensure error flows do not invite users to run commands or bypass controls. | ||
| NIST CSF 2.0 | PR.AT-01 — All users are informed and trained | The attack depends on users recognizing fake verification prompts. |
| Recommendation — Train users to treat any paste-and-run request as hostile. | ||
Practitioner Guidance
What to verify: Treat any website that asks a user to open a shell, terminal, Run dialog, or other system tool as suspicious by default. The key question is not whether the page looks polished, but whether the requested action belongs inside the business process at all.
What good looks like: Users should have a clear rule that browser-based verification, CAPTCHA, and support prompts never require pasted commands outside approved IT workflows. If a workflow genuinely needs local execution, it should be delivered through a controlled support channel, not a page that can be impersonated.
Practitioner takeaway: The most effective control is to remove the user’s incentive to “fix” a browser problem by running code, because ClickFix succeeds when a fake web prompt is allowed to cross the boundary into local execution.
Related resources from NHI Mgmt Group
- Guide: ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide
- How should security teams reduce the risk of ClickFix attacks that rely on users pasting commands into the Windows Run dialog?
- What breaks when users can run trusted tools in a ClickFix attack?
- What do security teams get wrong about malicious copy and paste attacks that deliver infostealers?
- How should security teams stop fake CAPTCHA attacks before users execute malicious code?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org