ClickFix: The Social Engineering Technique That Tricks Victims Into Infecting Themselves

What Is ClickFix?

ClickFix is a social engineering technique that manipulates victims into voluntarily executing malicious commands on their own devices. No exploit, no suspicious attachment — just a web page with seemingly official instructions and a victim who presses Enter.

This is not a technical vulnerability. It is an attack on human psychology — far more difficult for conventional security technology to block, because the user themselves becomes the 'last-mile executor' of the attack.

How ClickFix Works — Step-by-Step

ClickFix succeeds because its presentation is convincing and its instructions feel routine. Here is the complete anatomy of this attack from initial contact to infection.

History & Evolution of ClickFix

ClickFix did not emerge overnight. It evolved gradually from a simple trick into the preferred tool of nation-state espionage groups.

Who Is Using ClickFix?

What makes ClickFix especially alarming is not just its prevalence, but who is using it. Within a 90-day window between October 2024 and January 2025, five nation-state groups from four different countries adopted this technique — an unprecedented rate of criminal-to-state-actor technology transfer.

Malware Delivered via ClickFix

ClickFix is payload-agnostic — it is simply a delivery mechanism. Once the victim executes the command, virtually any type of malware can be deployed. This is what makes it so dangerous: a single social engineering technique can result in data theft, ransomware, or espionage operations.

Documented Real-World Incidents & Campaigns

ClickFix is not merely a theoretical technique. The following are well-documented campaigns and incidents that demonstrate the real-world impact of these attacks across industries and geographies.

Statistics & Prevalence 2025

The following quantitative data illustrates the massive scale of ClickFix adoption in a short period — from a niche technique to a global threat faced by nearly every organization.

Why Do Users Fall Victim?

ClickFix succeeds not because of technology failure, but because it exploits how the human brain works. Understanding these psychological factors is the first step in building effective security awareness.

How to Detect ClickFix Attacks

ClickFix is designed to evade traditional detection because no malicious file is downloaded initially — only a user executing a command. However, there are several artifacts and signals that can be detected.

ClickFix Prevention & Mitigation

No single control is sufficient to stop ClickFix. A combination of technical hardening, personnel training, and layered detection capabilities is required.

• Security Awareness Training

  Train users to NEVER execute commands from web page instructions. Show real examples of ClickFix pages. Communicate clearly: 'No legitimate CAPTCHA will ever ask you to open the Run dialog or a Terminal.'

• Disable Windows Run Dialog via GPO

  User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu. This eliminates the primary execution vector for ClickFix.

• PowerShell Hardening

  Apply Constrained Language Mode, enable Script Block Logging and Transcription Logging, and set Execution Policy to AllSigned or Restricted for non-administrator users.

• Block mshta.exe for Standard Users

  MSHTA is a Living Off the Land Binary (LOLBIN) favored by ClickFix. Deploy AppLocker or WDAC to prevent its execution by non-administrator users.

• Deploy EDR with Behavioral Protection

  Ensure your EDR can detect suspicious process chains and is updated with the latest ClickFix signatures. Behavioral detection is far more effective than signature-based approaches for this threat.

• DNS Filtering & Web Proxy

  Block known malicious domains, newly registered domains (<30 days), and uncategorized sites. A Malicious Domain Blocking and Reporting (MDBR) service provides an additional layer of protection.

• Email Security with URL Sandboxing

  Filter emails containing links to new domains, sandbox URLs before users can click them, and enforce SPF/DKIM/DMARC to prevent domain spoofing.

• Application Allowlisting

  Whitelist approved applications and block unknown executables from %APPDATA%, %TEMP%, and other directories commonly used by ClickFix loaders.

Southeast Asia & Indonesia Threat Landscape

While no fully documented ClickFix campaign has exclusively targeted Indonesia, several major campaigns have explicitly named Southeast Asia as a target region — and Indonesia's risk factors are highly significant.

The Storm-1865 campaign impersonating Booking.com (December 2024 – March 2025) explicitly targeted 'South and Southeast Asia' alongside North America, Oceania, and Europe. Given the scale of Indonesia's hospitality and tourism industry, the potential impact is very real.