ClickFix-Style Social Engineering: Why User Interaction Still Matters

What has been observed

The mechanism. Microsoft describes ClickFix as tricking users into running malicious commands under the cover of a fix, typically a CAPTCHA or a human-verification step. The lure arrives by phishing, malvertising or a compromised website. Unit 42 adds that the page uses JavaScript to place a command on the clipboard, a step it calls pastejacking, and then instructs the victim to open the Windows Run dialog or a terminal, paste and press Enter. Unit 42 also documents a Win+X variant that opens a terminal and avoids leaving an entry in the RunMRU registry key, which many hunts rely on.

Reach. Microsoft’s analysis describes campaigns aimed at thousands of enterprise and consumer devices every day. Its Defender Experts team saw thousands of devices a month where a ClickFix command was executed, even with EDR in place. Reported payloads include Lumma Stealer, which Microsoft calls the most prolific final payload it observed, plus Latrodectus, MintsLoader, DarkGate, NetSupport, AsyncRAT, Xworm and ScreenConnect. Several operations used legitimate-looking brand lures. Unit 42 recorded fake DocuSign and Okta pages leading to NetSupport RAT. Microsoft recorded a campaign impersonating the US Social Security Administration that delivered ScreenConnect, and a macOS campaign that delivered Atomic macOS Stealer.

Ransomware use. The FBI and CISA advisory on Interlock states that actors used drive-by downloads from compromised legitimate websites, which it calls atypical for ransomware actors, and that in some cases they used ClickFix: a fake CAPTCHA that gets the user to open the Run window and paste a Base64-encoded PowerShell command.

Why conventional controls miss it

Every layer sees something ordinary. Email filtering finds a link or nothing at all. Web filtering finds a legitimate site, often a compromised one. The endpoint sees a person, using their own session, open Run and launch PowerShell. Payloads are often fileless and run through trusted Windows binaries. Microsoft names msbuild.exe, regasm.exe and powershell.exe. The control that would normally stop an unknown file never gets a file to inspect.

That does not make EDR useless. Microsoft’s own figures show execution still happens on protected devices at scale, and the window between paste and payload is short. The point is that the earliest, cheapest place to break the chain is before the command can run.

Hardening that removes the capability

Detecting what the user ran

• RunMRU entries containing LOLBins, encoded commands or download-and-execute strings. Both Microsoft and Unit 42 point to this.

• The Win+X variant leaves no RunMRU entry. Look for powershell.exe spawned by explorer.exe in process creation events, and for elevated PowerShell shortly after login that launches certutil.exe, mshta.exe or rundll32.exe, as Unit 42 describes.

• Clipboard activity followed closely by shell execution, correlated per device.

• Script block logs showing encoded or downloaded content.

• Fake verification pages in web proxy and email telemetry, so a block can be turned into a hunt for who else saw the page.

What awareness training should say

Generic “don’t click links” advice misses this attack, because nothing needs to be clicked after the page loads. Teach one specific rule: no legitimate CAPTCHA, verification or update step asks you to paste a command into Run, a terminal or PowerShell. Pair it with a simple report path, because the person who stops after pasting but before pressing Enter is a detection source.

Measure reports and attempted execution, not clicks. In an authorized exercise, a benign and instrumented command can show who follows the instructions. Agree scope, consent and handling with legal and HR before running one.

Platform note

The same social-engineering pattern has been used against macOS users in a campaign that delivered Atomic macOS Stealer, per Microsoft. The Windows controls above do not apply. Check that terminal-paste behavior and endpoint coverage on Mac devices have an owner.

What is not known

Public figures come from vendor telemetry and incident-response caseloads, so they show that the technique is widespread but not how often a lure converts to execution. We have not seen an authoritative measure of that rate, and this brief does not estimate one.

Next step

Start with two questions: which users can open Run or a terminal and run PowerShell without a business need, and would you notice within minutes if one of them pasted a command from a web page? Phishing Operations exercises can then test whether training, controls and detection hold together.

Sources

1. Microsoft Security Blog. Think before you ClickFix: analyzing the ClickFix social engineering technique. microsoft.com

2. Palo Alto Networks Unit 42. Preventing the ClickFix attack vector. unit42.paloaltonetworks.com

3. CISA and FBI. #StopRansomware: Interlock. cisa.gov