Skip to content
social engineering

ClickFix attacks: what they are and how to stop them

ClickFix tricks users into running malicious commands via fake meeting errors or CAPTCHAs, letting attackers bypass file‑based defenses. Learn how the technique works and how CrowdStrike’s Falcon platform can stop it at every stage.

A team engages in a video conference call with a colleague over a computer screen in a colorful office.

When employees click links that appear to fix a broken video‑meeting or a missing CAPTCHA, they may be unwittingly running commands that give an attacker control of their workstation. This social‑engineering trick, known as ClickFix, moves the breach from a compromised web page into trusted operating‑system tools such as the Windows Run dialog or PowerShell, sidestepping traditional file‑based protection. Organisations that rely on web‑based collaboration tools and remote access are therefore exposed to a new vector that blends phishing with legitimate system utilities.

How ClickFix works in practice

ClickFix presents a seemingly harmless problem‑solving step, for example, a pop‑up that claims a meeting failed to start, or a fake CAPTCHA that refuses to load. The message copies a command into the user’s clipboard and asks them to paste it into a command prompt to “fix” the issue. Because the command runs in a trusted environment, endpoint security that only scans downloaded files often misses the malicious payload.

Real‑world examples

  • STARDUST CHOLLIMA used a forged video‑meeting error in July 2026. The lure delivered PowerShell and VBScript code that installed the previously unknown GeniexLoader and GeniexRAT families. The attack chain showed how a simple copy‑and‑paste step can seed a full‑blown remote‑access trojan.
  • VOODOO BEAR compromised Ukrainian news sites and injected fake CAPTCHAs. Visitors who solved the CAPTCHA were prompted to run a PowerShell command that fetched a VBScript payload, giving the threat actor a foothold on the victim’s machine.

These incidents illustrate that ClickFix is not a theoretical threat, it is being used by sophisticated actors to bypass perimeter controls.

A diverse group participates in a virtual meeting using modern technology.

Photo by MART PRODUCTION on Pexels

Why the numbers matter

The 2026 Global Threat Report recorded a 563 % increase in incidents that involved fake CAPTCHA lures during 2025. The surge indicates that attackers are refining the ClickFix playbook and that organisations are likely to see more of these lures in the coming months.

Defending against ClickFix with the Falcon platform

CrowdStrike’s Falcon suite provides layered protection that intercepts the attack at several points:

  • Falcon Seraphic Enterprise Browser extends security into the browser session where ClickFix begins, breaking the copy‑and‑paste mechanism before the command reaches the operating system.
  • Falcon Prevent and Falcon Insight XDR monitor command‑line activity and can block suspicious PowerShell, VBScript, and other script execution that matches the ClickFix pattern.
  • Falcon Identity Threat Protection watches for credential abuse and lateral movement that often follow a successful ClickFix compromise.
  • Falcon Next‑Gen SIEM correlates telemetry from endpoints, identity services, browsers and cloud workloads, stitching together a complete picture of an intrusion after the initial command runs.
  • Falcon Adversary OverWatch™ and Falcon Complete add continuous threat hunting, investigation, containment and remediation, ensuring that any missed activity is discovered and neutralised.
A professional engaged in a video conference in a modern office setting.

Photo by Vitaly Gariev on Pexels

Practical steps for security teams

  1. Deploy browser‑level protection, enable Falcon Seraphic Enterprise Browser across all corporate browsers to stop malicious copy‑and‑paste attempts at the source.
  2. Enforce script‑execution policies, configure Falcon Prevent and Falcon Insight XDR to alert on and block unknown PowerShell or VBScript commands that originate from a web‑originated clipboard.
  3. Monitor identity abuse, use Falcon Identity Threat Protection to detect anomalous credential use that may indicate post‑ClickFix lateral movement.
  4. Correlate signals, integrate Falcon Next‑Gen SIEM so that alerts from the browser, endpoint and identity layers are linked, giving analysts a single view of the attack chain.
  5. Leverage managed hunting, consider Falcon Adversary OverWatch™ or Falcon Complete for 24/7 hunting and rapid response, especially if you lack a dedicated threat‑intel team.

By applying these controls, organisations can turn a technique that relies on human error into a detectable and preventable event.

Terms used in this article

  • PowerShell, a command‑line shell and scripting language built into Windows, often used by administrators for automation.
  • VBScript, a scripting language for Windows that can run small programs, historically used for web page automation.
  • SIEM, Security Information and Event Management; a system that collects and analyses security logs from many sources.
  • Credential abuse, the unauthorised use of stolen usernames and passwords to access systems.
  • Lateral movement, the technique attackers use to move from an initially compromised host to other devices on the network.

Read next