ClickFix is a social engineering attack in which a web page shows a fake error or verification prompt and talks the visitor into pasting a command the attacker has already copied to their clipboard. The victim runs it themselves. No file is downloaded, no vulnerability is exploited, and the first four steps happen entirely inside a browser tab.
That last point is the one that matters for defenders, and it is the one most guides skip. ClickFix is usually described as an endpoint problem: the pasted command runs PowerShell or Terminal, so the answer is endpoint detection and user awareness. Both help. But the lure, the clipboard hijack and the instruction to paste all happen in the browser, before any endpoint control can see anything. That is where the chain is cheapest to break, and it is where the SenseOn Universal Sensor, extended into the browser, is designed to act.
This article explains how ClickFix works, why it has grown so fast, what it looks like in a real incident, and which layer of defence stops which stage. For the full technical reference, including registry artefacts, hunting queries and a thirteen-item hardening list, see the ClickFix defence guide on SenseOn Docs.
What a ClickFix attack looks like
The pattern is consistent across almost every campaign, whatever the lure and whatever the payload.
- Delivery. The victim lands on a page: a compromised legitimate website, a malicious advert, a phishing link, a fake download portal, or a spoofed meeting invite.
- The lure. The page shows a fake CAPTCHA ("Verify you are human"), a browser or Windows error, an "update in progress" screen, or a "this document can't be displayed" message. Cloudflare and Google reCAPTCHA branding are the most copied.
- Clipboard hijack. Ticking the box or clicking "Fix" runs JavaScript that silently copies an attacker-controlled command to the clipboard. What is shown on screen is often harmless decoy text. The real payload is in the clipboard.
- The instruction. The page tells the victim to press Win+R, open PowerShell or Terminal, paste, and press Enter.
- Execution. A trusted, signed interpreter already on the machine runs the command, which usually fetches the next stage in memory.
Everything up to and including step four is browser behaviour. Step five is the endpoint.
MITRE catalogued the technique in March 2025 as ATT&CK sub-technique T1204.004, User Execution: Malicious Copy and Paste. It emerged in campaigns from late 2023, hosted on the compromised-site infrastructure tracked as ClearFake, and is now one of the most common initial-access vectors in circulation.
Why it works so well
ClickFix does not need a vulnerability and does not need a download. Because the victim runs the command with a legitimate interpreter, the controls built to catch malicious files never see a file: attachment filtering, browser sandboxing, reputation checks and file-based antivirus all sit downstream of a step that never happens.
It is cross-platform. The same lure works against Windows (Run dialog, PowerShell, mshta), macOS (Terminal, zsh, AppleScript) and Linux, with only the target interpreter changing.
And it scales. ClickFix-as-a-service kits are sold on criminal forums with CAPTCHA templates, rotating domains and a choice of payload. Most campaigns are opportunistic: the victim is compromised for visiting a hijacked page, not because they were targeted. The resulting access is then sold on, often to ransomware operators, which is why containment speed matters even when the first payload is an unremarkable infostealer.
What is being seen in 2026
Three trends stand out from the public record.
- Volume, and scale through the supply chain. ESET reported a 517% rise in ClickFix detections between the second half of 2024 and the first half of 2025, and UK search interest in the term has kept climbing through 2026. Two incidents in September 2026 showed how far one campaign now reaches. On 14 September attackers used a Cloudflare API key taken from the marketing platform Brevo's source code to rewrite Brevo's scripts at the CDN edge for about five and a half hours. Visitors to up to 100,000 customer websites saw a fake "Cloudflare, verify you are human" page with paste-and-run instructions (first reported by Sansec; BleepingComputer, 17 September 2026). The same day TechCrunch reported that HBO Max's verified Reddit advertising account had been hijacked to run ads leading to a fake HBO Max page. Mac and Windows users were told to paste a command into Terminal or Command Prompt, which installed an infostealer built to take passwords, sessions and cryptocurrency wallets (identified by Hudson Rock and ADAMnetworks; BleepingComputer counted 108 ads, 36 of them dressed as AI coding tools).
- Evasion of the obvious fixes. Organisations that disabled Win+R via Group Policy met FileFix, which targets the File Explorer address bar instead. On macOS, Netskope documented 2026 campaigns delivering AppleScript-based stealers through ClickFix lures, and pointed users to the native Terminal warning Apple introduced in macOS 26.4 as the mitigation; the lures moved to other execution paths within weeks.
- Lures that follow the work. Fake "fix your audio before joining" prompts aimed at customer-facing staff who join external calls all day. AI-tool onboarding lures aimed at organisations with public AI initiatives. And ConsentFix, which drops the pasted command altogether and walks the victim through a genuine OAuth consent screen, granting a malicious app persistent access that survives password resets and shows up in logs as ordinary authorised activity.
The lesson from all three is the same: controls that key on one system surface (Win+R, Terminal, a specific lure wording) get routed around within weeks. Controls that key on the pattern last longer.
A real incident, stage by stage
Mapped against the tactics it touches, a typical ClickFix incident looks like this.
| Stage | What happens | Where it is visible |
|---|---|---|
| Initial access | User visits a legitimate but compromised site; the page waits for the paste | Browser only |
| Execution | explorer.exe or a browser process spawns an obfuscated one-line PowerShell command | Endpoint |
| Command and control | Plain HTTP to fetch the payload, then a TLS beacon to a separate host | Network |
| Discovery | whoami /groups, net group "domain computers" /dom | Endpoint |
| Persistence | A hidden script dropped to disk and re-run by a scheduled task | Endpoint |
The social engineering is over in under a minute. The process tree it leaves behind (browser → explorer.exe → PowerShell → dropped script → scheduled task → discovery commands) is long-lived and rich in detection opportunities. Hunting on command-line length rather than lure wording is far more durable: practitioners cited in the SenseOn Docs guide put the average observed ClickFix command at around 179 characters.
Which control stops which stage
This is the table most guides do not draw. Each stage of ClickFix is visible to a different layer, and no single layer sees the whole thing.
| Stage | Awareness training | Network / DNS blocking | Endpoint detection (EDR/EPP) | Universal Sensor in the browser (SenseOn, in design) |
|---|---|---|---|---|
| Lure page loads | Helps if the person recognises it | Blocks known-bad domains only; misses compromised legitimate sites and fresh domains | Sees nothing yet | Will block known lure domains before the page loads, and will neutralise the fake-verification modal on unknown ones: blur it, overlay a warning, disable interaction |
| Clipboard hijack | Invisible to the user | Invisible | Invisible | Will neutralise the lure before the interaction that triggers the copy |
| Instruction to paste | The one line to teach: no legitimate site ever asks you to paste a command | Invisible | Invisible | Will lock the prompt so the instruction cannot be followed |
| Execution | Too late | Sees the payload fetch, if not on an allowed CDN | Sees explorer.exe spawn PowerShell; the strongest single signal | Outside the browser; hands off to the endpoint agent |
| C2, discovery, persistence | Too late | Sees the beacon | Sees the process tree and scheduled task | Outside the browser |
Two honest limits. The browser sensor will stop the browser stages, not the whole attack: the execution stage is endpoint work, and the Universal Sensor on the endpoint covers it. And neutralising a modal on an arbitrary page needs broader page access than the base sensor, which is why that capability will be a deliberate, gated choice rather than on by default.
What the Universal Sensor will do in the browser
Everything in this section describes intended design; availability and timing will be announced separately.
SenseOn is extending the Universal Sensor, the single agent that already collects endpoint and network telemetry on Windows, macOS and Linux, into the browser with a managed extension. It will be deployed through your existing enterprise browser policy and will feed the same telemetry pipeline as the rest of the platform. For ClickFix it is designed to act in two places.
- Known lure domains will be blocked at the network layer using the browser's declarativeNetRequest engine, which runs below page JavaScript so a hostile page cannot unhook it. The page never loads.
- Unknown lures will be recognised by pattern and neutralised in the extension's isolated world: the fake CAPTCHA or verification pop-up is blurred, a warning is overlaid, and all interaction is disabled. The user cannot be led to the next click. This is the part of a ClickFix attack a browser can actually stop.
Browser and endpoint events will share a device identity, so a neutralised lure and the PowerShell it would have spawned will appear in one SenseOn investigation rather than two. Warning will be the default; blocking and neutralisation will be enabled per tenant by the security team. The browser sensor page has the full design, and the shadow AI guide covers the data-out side of the same tab.
What to do now, without waiting for a sensor
The docs guide carries the full list. The five with the best return in most UK estates:
- Turn on PowerShell script block logging. The single most valuable artefact for investigating a suspected execution after the fact.
- Enforce Constrained Language Mode via WDAC or AppLocker, which removes the .NET and COM access most payloads rely on even when the command runs.
- Block or restrict mshta.exe. The docs guide notes that a WDAC policy blocks it in many configurations even in audit-only mode; test in your estate before relying on it.
- Restrict OAuth app consent to admin approval. This is the only control on the list that touches ConsentFix.
- Teach one line, not a module: no legitimate website, vendor or internal system will ever ask you to paste a command into a system window. Cover the current lure contexts (meeting fixes, document errors, AI-tool onboarding), not just email attachments.
Disabling Win+R is worth doing as a speed bump. It does nothing against FileFix.
If you think someone has run one
Isolate the device first and characterise the payload second. Reset the user's credentials and revoke sessions and refresh tokens, because cached tokens may be usable elsewhere. Check OAuth grants and inbox rules. Reimage rather than clean. Block the delivery and C2 infrastructure and look for other devices that touched it. Then talk to the user: what the lure looked like is the fastest route to related exposure and to the awareness content that will actually help next time.
Frequently asked questions
What is a ClickFix attack? A social engineering technique in which a web page shows a fake error or verification prompt and instructs the visitor to paste and run a command that the page has silently copied to their clipboard. The command installs malware or, in the ConsentFix variant, grants a malicious app OAuth access.
Is a fake CAPTCHA the same as ClickFix? The fake CAPTCHA is the most common ClickFix lure. Fake browser updates, fake Windows updates, fake meeting "fixes", fake document errors and fake macOS password prompts are others. The mechanism underneath is the same.
Can a browser extension stop ClickFix? It can stop the browser stages: blocking known lure domains before they load and neutralising the fake prompt so the user cannot follow it. It cannot see the execution stage, which happens in PowerShell or Terminal outside the browser; that is the endpoint agent's job. Both are needed.
Does disabling Win+R stop ClickFix? It stops the original variant. FileFix targets the File Explorer address bar instead, and macOS variants use Terminal or Script Editor. Treat it as one control among several.
What is FileFix? A ClickFix variant that instructs the victim to paste into the File Explorer or Finder address bar rather than the Run dialog or a terminal, specifically to defeat policies that only disable Win+R.
Sources and further reading
- SenseOn Docs, ClickFix: Recognising and Preventing Fake Fix Attacks
- MITRE ATT&CK T1204.004
- Microsoft Security, "Think before you Click(Fix)" (Aug 2025)
- ESET Threat Report H1 2025, as reported by Infosecurity Magazine, "ClickFix Attacks Surge 517% in 2025" (Jun 2025)
- Netskope Threat Labs, "macOS ClickFix campaign: AppleScript stealers and new terminal protections" (2026)
- Unit 42, "Fix the Click" (Jul 2025)
- Sansec, "Brevo supply chain attack" and BleepingComputer, "Brevo supply-chain attack injected ClickFix scripts on customer sites" (17 Sep 2026)
- TechCrunch, "ClickFix attacks are tricking Mac and Windows users into hacking themselves" (14 Sep 2026)
- BleepingComputer, "Hackers hijack HBO Max Reddit account to push malware in ClickFix ads" (Sep 2026).
Capability statements about the Universal Sensor's browser coverage describe intended design.
