As a small or medium-sized business (SMB), you likely have firewalls, email filters, and antivirus software in place to catch malicious downloads. Those tools work, unless a cybercriminal tricks you or your employees to hack their own computers.
ClickFix is a growing social engineering tactic that is unique because it bypasses traditional security barriers by tricking users into manually executing malicious code. As opposed to operating as a traditional software bug or system vulnerability, it works by executing a few steps:
- A user visits a compromised website or a spoofed page disguised as a familiar tool, like Google Meet.
- A pop-up appears – it could be a failed Cloudflare CAPTCHA verification
- That pop-up prompts the user to click a button to “fix” the issue. But that fix (a trick called pastejacking) copies code to the user’s clipboard and then instructs the user to use a system tool (like the Windows Run dialog using the Win + R shortcut) in order to paste the needed fix.
Because the employee manually pastes and runs the command, the malicious script bypasses standard browser security and email sandboxes entirely.
First detected in 2024, the ClickFix tactic is surging and today is a major evolving threat – evolving because it keeps rolling out in new variations. The threat to your business includes theft of credentials, a remote trojan takeover of your machine, and even access to your entire network.
A mix of system controls ad employee education can help:
Protect yourself
- Legitimate websites will never ask you to open your command prompt, Terminal, or Run dialog to fix a web page.
- Users should be skeptical of any website that instructs them to use keyboard shortcuts like Win + R or Ctrl + V to resolve an error.
- Your employees should not be shy about stopping and reporting unusual browser behaviors to your IT experts, rather than trying to fix it themselves.
- Utilize modern security platforms (like Microsoft Defender XDR or CrowdStrike) that actively monitor for anomalous script behaviors, such as PowerShell executing commands directly from a user’s clipboard.
Partner With the Experts
Cyber threats change daily, and keeping up with tactics like ClickFix can be a full-time job. If you want to ensure your business network is fully monitored and your team is trained against the latest exploits, we are here to help.
Contact us today for a comprehensive cybersecurity assessment to find and patch the hidden vulnerabilities in your business defenses.
Philipp Emma | philipp@psntech.com | 313-715-3421 (cell)