What is ClickFix?
ClickFix (also known as "paste and run") is a social engineering technique in which cybercriminals trick you into running malicious commands on your computer.
Instead of downloading an installer or opening an attachment, the attack works like this:
- You visit a compromised website or receive a popup (often impersonating a CAPTCHA verification, a Google Meet error, an MS Teams update glitch, or a browser loading issue).
- The popup claims you need to "fix" the issue to proceed.
- Clicking a button on the screen automatically copies hidden code into your system’s clipboard.
- The page instructs you to open your system's command prompt (e.g., pressing Win + R, Win +X or opening Terminal), press Ctrl + V, then press Enter.
This directly executes malware (like info-stealers or remote access tools) on your machine, bypassing standard web browser protections.
How to Spot a ClickFix Scam
- Demands to open system tools: Legitimate websites and CAPTCHAs will never ask you to press Win + R, Win+X, launch PowerShell/Terminal, or paste text to verify you are human or fix a video error.
- Copy-paste prompts: Any error message that instructs you to manually paste terminal commands is a major red flag.
- Urgent error alerts: Messages claiming your document, meeting, or browser is broken and requires an immediate technical "fix."
How to Stay Safe
- Never copy-paste code from a pop-up window: Unless you are a developer actively working on trusted code, never paste unverified commands into your computer's terminal or "Run" menu.
- Close the tab: If a webpage tells you to press shortcut keys to run commands, close the browser window immediately.
- Report suspicious alerts: If you encounter a ClickFix prompt on an internal system or work device, notify your IT support team right away.
Below are a few examples of what ClickFix-type pop-ups will look like:
Security News