How ClickFix Works: The Four-Step Deception

The attack follows a consistent pattern across nearly all documented campaigns :

1. The lure: A user visits a compromised or rogue website and encounters a spoofed verification prompt — a fake Google reCAPTCHA, a counterfeit Cloudflare "Verify you are human" page, a fake browser update message, or a fraudulent QuickBooks or Booking.com error screen .
2. Copy-paste instruction: The page displays instructions such as: "Press Win + R, then press Ctrl + V, then press Enter" to complete the verification task .
3. The hidden payload: What was copied to the user's clipboard is a malicious PowerShell, mshta, or curl command that downloads and executes a malware loader from a remote server .
4. Execution: The command runs with the user's own privileges. Because the user pasted and launched it themselves, endpoint detection tools often fail to flag it as an intrusion .

This technique is also referred to as pastejacking because it exploits the clipboard as the infection vector .

Payloads Delivered in ClickFix Campaigns

Attackers have used ClickFix lures to deliver a wide range of malware, often in multi-stage infection chains:

• HijackLoader: A first-stage loader observed in ClickFix chains since at least June 2025, frequently followed by the DeerStealer infostealer .
• CastleLoader (aka CastleBot): A malware-as-a-service framework active since early 2025. One campaign used a fake background-removal website to deliver CastleLoader, which then installed NetSupport RAT and a custom .NET stealer targeting browser credentials, cryptocurrency wallets, and Telegram sessions .
• NetSupport RAT: A legitimate remote administration tool repurposed by attackers for persistent backdoor access .
• StealC: An information-stealing trojan that targets browser credentials and cryptocurrency wallets .
• Amatera: An infostealer distributed via a ClickFix campaign that combined fake CAPTCHAs with signed Microsoft App-V scripts .
• Rust-based stealer: Documented in polymorphic ClickFix campaigns that began in late 2025 .
• DeerStealer: Observed as the final executable payload delivered after HijackLoader .
• ResiLoader: A newly documented loader designed specifically to terminate over 140 antivirus and security-tool processes on the victim's machine, effectively disabling defenses before the final payload runs .

Distribution Methods

Attackers leverage a broad mix of infrastructure to host and deliver ClickFix attacks:

• Cloudflare R2 storage: Used to host malicious payload binaries .
• Cloudflare Pages subdomains: Abused to serve fake CAPTCHA pages with Cloudflare's own trusted certificate .
• Dedik Services Limited hosting: Observed as a hosting provider for ClickFix command-and-control infrastructure .
• Expired domains: Registered or re-registered expired domains used for credential-harvesting and payload delivery .
• Compromised websites: The most common initial vector. Attackers inject malicious JavaScript or iframes into legitimate sites (often via plugin vulnerabilities or CMS exploits) that redirect visitors to ClickFix landing pages .
• SEO poisoning and malvertising: Fake installer sites and pirated-software portals pushed via search-engine results .
• Ghost CMS vulnerability exploitation: In May 2026, attackers abused a critical Ghost CMS SQL injection vulnerability (CVE‑2026‑26980) to hijack over 700 legitimate education and tech websites and inject ClickFix prompts .

Threat Significance: Why ClickFix Dominates

• Microsoft's 2025 Digital Defense Report identified ClickFix as the #1 initial access method, responsible for 47% of all attacks observed by Microsoft Defender Experts over the prior year — surpassing traditional phishing (35%) .
• ESET telemetry recorded a 517% surge in ClickFix attacks in the first half of 2025 alone .
• In one campaign documented by Menlo Labs, ClickFix delivered cross-platform payloads: Windows PowerShell commands, macOS .command scripts, and Linux Bash scripts from a single polymorphic JavaScript lure .
• The U.S. Department of Health and Human Services (HHS) issued a sector alert on ClickFix in July 2026, confirming the technique's reach into critical infrastructure .
• Recorded Future's Insikt Group assessed in March 2026 that ClickFix will likely remain the dominant initial access vector throughout 2026 .

Defensive Measures: What Researchers Recommend

Because ClickFix exploits human behavior rather than a software vulnerability, defense relies heavily on technical controls and user awareness :

• Restrict PowerShell execution: Block non-administrative users from running PowerShell scripts. Set the execution policy to Restricted via Group Policy and log all PowerShell execution events .
• Disable the Windows Run box: A registry modification (NoRun policy) can prevent Win+R from being used to paste and execute commands .
• Treat unsolicited command-prompt instructions as red flags: No legitimate website or service asks a user to press Win+R, paste a command, and hit Enter. This should be the top user-awareness training item .
• Block mshta, cscript, and curl from user-context execution: Use AppLocker or Windows Defender Application Control to restrict script interpreters .
• Deploy endpoint detection rules: Monitor for unusual powershell.exe -ep bypass parent processes, process lineage from explorer.exe to script interpreters, and RunMRU registry artifacts .
• Use clipboard security features: Browser-level clipboard protections can prevent the core copy-paste mechanism that ClickFix relies on.

Opera's Paste Protect Feature

Opera introduced a native Paste Protect feature (available in Opera 100+ across Windows, macOS, and Linux) that intercepts and blocks clipboard-based pastejacking attacks. When a website attempts to programmatically write a suspicious payload to the clipboard and then prompts the user to paste it, Paste Protect warns the user and blocks the operation from completing. This directly mitigates the core ClickFix technique without requiring any extension installation.

How ClickFix Works: The Four-Step Deception

The attack follows a consistent pattern across nearly all documented campaigns :

1. The lure: A user visits a compromised or rogue website and encounters a spoofed verification prompt — a fake Google reCAPTCHA, a counterfeit Cloudflare "Verify you are human" page, a fake browser update message, or a fraudulent QuickBooks or Booking.com error screen .
2. Copy-paste instruction: The page displays instructions such as: "Press Win + R, then press Ctrl + V, then press Enter" to complete the verification task .
3. The hidden payload: What was copied to the user's clipboard is a malicious PowerShell, mshta, or curl command that downloads and executes a malware loader from a remote server .
4. Execution: The command runs with the user's own privileges. Because the user pasted and launched it themselves, endpoint detection tools often fail to flag it as an intrusion .

This technique is also referred to as pastejacking because it exploits the clipboard as the infection vector .

Payloads Delivered in ClickFix Campaigns

Attackers have used ClickFix lures to deliver a wide range of malware, often in multi-stage infection chains:

• HijackLoader: A first-stage loader observed in ClickFix chains since at least June 2025, frequently followed by the DeerStealer infostealer .
• CastleLoader (aka CastleBot): A malware-as-a-service framework active since early 2025. One campaign used a fake background-removal website to deliver CastleLoader, which then installed NetSupport RAT and a custom .NET stealer targeting browser credentials, cryptocurrency wallets, and Telegram sessions .
• NetSupport RAT: A legitimate remote administration tool repurposed by attackers for persistent backdoor access .
• StealC: An information-stealing trojan that targets browser credentials and cryptocurrency wallets .
• Amatera: An infostealer distributed via a ClickFix campaign that combined fake CAPTCHAs with signed Microsoft App-V scripts .
• Rust-based stealer: Documented in polymorphic ClickFix campaigns that began in late 2025 .
• DeerStealer: Observed as the final executable payload delivered after HijackLoader .
• ResiLoader: A newly documented loader designed specifically to terminate over 140 antivirus and security-tool processes on the victim's machine, effectively disabling defenses before the final payload runs .

Distribution Methods

Attackers leverage a broad mix of infrastructure to host and deliver ClickFix attacks:

• Cloudflare R2 storage: Used to host malicious payload binaries .
• Cloudflare Pages subdomains: Abused to serve fake CAPTCHA pages with Cloudflare's own trusted certificate .
• Dedik Services Limited hosting: Observed as a hosting provider for ClickFix command-and-control infrastructure .
• Expired domains: Registered or re-registered expired domains used for credential-harvesting and payload delivery .
• Compromised websites: The most common initial vector. Attackers inject malicious JavaScript or iframes into legitimate sites (often via plugin vulnerabilities or CMS exploits) that redirect visitors to ClickFix landing pages .
• SEO poisoning and malvertising: Fake installer sites and pirated-software portals pushed via search-engine results .
• Ghost CMS vulnerability exploitation: In May 2026, attackers abused a critical Ghost CMS SQL injection vulnerability (CVE‑2026‑26980) to hijack over 700 legitimate education and tech websites and inject ClickFix prompts .

Threat Significance: Why ClickFix Dominates

• Microsoft's 2025 Digital Defense Report identified ClickFix as the #1 initial access method, responsible for 47% of all attacks observed by Microsoft Defender Experts over the prior year — surpassing traditional phishing (35%) .
• ESET telemetry recorded a 517% surge in ClickFix attacks in the first half of 2025 alone .
• In one campaign documented by Menlo Labs, ClickFix delivered cross-platform payloads: Windows PowerShell commands, macOS .command scripts, and Linux Bash scripts from a single polymorphic JavaScript lure .
• The U.S. Department of Health and Human Services (HHS) issued a sector alert on ClickFix in July 2026, confirming the technique's reach into critical infrastructure .
• Recorded Future's Insikt Group assessed in March 2026 that ClickFix will likely remain the dominant initial access vector throughout 2026 .

Defensive Measures: What Researchers Recommend

Because ClickFix exploits human behavior rather than a software vulnerability, defense relies heavily on technical controls and user awareness :

• Restrict PowerShell execution: Block non-administrative users from running PowerShell scripts. Set the execution policy to Restricted via Group Policy and log all PowerShell execution events .
• Disable the Windows Run box: A registry modification (NoRun policy) can prevent Win+R from being used to paste and execute commands .
• Treat unsolicited command-prompt instructions as red flags: No legitimate website or service asks a user to press Win+R, paste a command, and hit Enter. This should be the top user-awareness training item .
• Block mshta, cscript, and curl from user-context execution: Use AppLocker or Windows Defender Application Control to restrict script interpreters .
• Deploy endpoint detection rules: Monitor for unusual powershell.exe -ep bypass parent processes, process lineage from explorer.exe to script interpreters, and RunMRU registry artifacts .
• Use clipboard security features: Browser-level clipboard protections can prevent the core copy-paste mechanism that ClickFix relies on.

Opera's Paste Protect Feature

Opera introduced a native Paste Protect feature (available in Opera 100+ across Windows, macOS, and Linux) that intercepts and blocks clipboard-based pastejacking attacks. When a website attempts to programmatically write a suspicious payload to the clipboard and then prompts the user to paste it, Paste Protect warns the user and blocks the operation from completing. This directly mitigates the core ClickFix technique without requiring any extension installation.