A ClickFix attack is a form of social engineering where a user is tricked into manually executing malicious commands or code under the belief they are fixing an issue. Instead of exploiting a technical vulnerability, the attacker relies on convincing the user to take an action that bypasses traditional security controls.
In most cases, the user is presented with a message that appears legitimate, such as a CAPTCHA, browser error, or application issue, and is instructed to follow steps to “resolve” the problem. These steps often involve copying and running commands in tools such as PowerShell, Command Prompt, or the Windows Run dialog. Once executed, the command retrieves and runs a malicious payload.
Figure 1: Example of a ClickFix attack using a fake CAPTCHA
In this example, the user is presented with a fake CAPTCHA. Following these instructions will run malicious code that downloads and installs an infostealer.
ClickFix attacks are effective because they shift the burden of execution to the user, allowing attackers to bypass many automated protections that rely on detecting suspicious files or exploit behavior.
How ClickFix attacks work
ClickFix attacks typically begin with a user interacting with malicious or compromised content. This could include a phishing email, a drive-by website, or a fake software prompt. The user is then presented with instructions that guide them through what appears to be a harmless troubleshooting process.
Instead of downloading a malicious file directly, the attacker provides a command or script that the user is told to execute themselves. This might be framed as a necessary step to fix a browser issue, enable content, or resolve a system error. Because the action is initiated by the user, it often avoids raising immediate suspicion.
Once the command is executed, it typically reaches out to an attacker-controlled server to download and run additional payloads. These payloads can include loaders, infostealers, or backdoors, which then establish persistence or move laterally within the environment.
In many cases, the initial action appears benign on the surface. The malicious behavior only becomes visible after the command pulls down secondary components, making detection more difficult if monitoring is not focused on execution behavior and command-line activity.
Why ClickFix attacks are effective
ClickFix attacks present a unique challenge because they exploit trust and normal administrative workflows. Users are often accustomed to following remote instructions to resolve technical issues. When an attacker mimics this process, the request can appear legitimate, especially if it resembles common troubleshooting steps. This makes it easier for the attacker to convince the user to execute commands without raising suspicion.
Additionally, because the execution is initiated by a legitimate user account, the activity can blend into normal operations. Traditional defenses that rely on blocking malicious files or detecting exploit behavior may not trigger, since the attack does not begin with a typical malware drop or exploit chain.
The risk is amplified when users have access to tools such as PowerShell or when administrative privileges are too broadly assigned. In these cases, a single successful ClickFix interaction can lead to rapid payload execution and potential spread across multiple systems.
Real-world example of a ClickFix attack
A common ClickFix scenario involves a user being directed to a webpage that displays an error message indicating that content cannot load or that a plugin needs to be enabled. The page provides step-by-step instructions to resolve the issue, typically telling the user to open a command prompt or PowerShell window and paste in a provided command.
The command may look technical, but harmless, to a non-expert user. However, when executed, it connects to a remote server and downloads a payload, such as an infostealer or loader. From there, the attacker can begin harvesting credentials, executing additional malware, or establishing persistence.
In SOC investigations, this type of activity often appears as a user-initiated command that retrieves and executes remote code. The initial trigger may not look like a traditional phishing or malware event, which can delay detection if teams are not actively monitoring command execution and outbound connections.
Variants of ClickFix-style attacks
ClickFix is not a single technique but part of a broader pattern of social engineering attacks that rely on convincing users to execute actions themselves. As this approach has evolved, attackers have adopted different variations that follow the same core idea while changing how the request is presented to the user.
Some commonly observed variants include:
FileFix
In this variation, the user is prompted to download and open a file as part of a supposed fix. The file is often disguised as a tool, document, or update needed to resolve an issue. Once opened, it executes a malicious payload.
ConsentFix
This approach focuses on prompting the user to approve or “consent” to a request, often through system dialogs or authentication prompts. The action may grant permissions, authorize access, or enable a connection that the attacker can then leverage.
CrashFix
In this scenario, the user is told that an application or system has encountered an error and must be repaired. The instructions may involve running commands or installing a component to restore functionality, which instead introduces malicious code into the environment.
While the delivery and messaging vary, each of these techniques relies on the same underlying principle: shifting execution from the attacker to the user. By making the action appear legitimate and necessary, attackers are able to bypass many traditional security controls.
For MSPs, this means focusing not just on blocking malicious files or links, but on identifying and controlling risky user-initiated actions across endpoints.
How to detect ClickFix attacks
Detecting ClickFix attacks requires a shift away from file-based detection toward monitoring user behavior and command execution.
Security teams should focus on identifying unusual command-line activity, especially when users who do not typically execute scripts begin running PowerShell or command prompt commands. Particular attention should be paid to commands that retrieve content from external sources or execute encoded scripts.
It is also important to monitor for patterns where legitimate tools are used to initiate outbound connections shortly before suspicious activity occurs. Because ClickFix attacks often rely on staging payloads remotely, these connections can serve as an early indicator.
Behavioral monitoring is critical, as the initial execution may not involve a known malicious file. Instead, detection relies on identifying deviations from normal user activity and recognizing the sequence of actions that leads to payload execution.
How to defend against ClickFix attacks
Defending against ClickFix attacks requires a combination of user awareness, access control, and behavioral detection.
Users should be trained to recognize situations where they are being asked to manually execute commands, especially when those instructions come from unexpected sources or unfamiliar interfaces. Clear guidance should be provided that legitimate support processes will not require copying and running unknown commands without proper verification.
From a technical standpoint, limiting the use of scripting tools and enforcing least privilege can reduce the impact of a successful attack. Restricting who can execute PowerShell or administrative commands helps prevent attackers from leveraging user actions to gain deeper access.
Monitoring and detection capabilities should be tuned to identify suspicious command execution, particularly when it involves downloading or executing remote content. This includes visibility into command-line parameters, script execution, and network activity tied to user-initiated processes.
Ultimately, ClickFix attacks reinforce the need for layered defenses that combine user education with strong behavioral monitoring. Because the attack relies on human action rather than technical exploitation, prevention depends on both awareness and the ability to detect abnormal activity quickly.
Want to learn more?
Download the 2026 MSP Threat Report to see how modern cyberthreats abuse trust, and visit connectwise.com/solutions/security-management to see how ConnectWise tools can help you defend against ClickFix attacks and beyond.