Clickfix a new method of cyberattack, forces users to get hacked

Oct Sun 2025 03:19:28

585 views

Clickfix a new method of cyberattack, forces users to get hacked

Microsoft recently issued a warning about the rise of a social engineering attack called ClickFix. Traditional anti-phishing methods are not enough to protect against this new style of attack. The ClickFix social engineering strategy has been gaining popularity among cybercriminals in recent times.

According to Microsoft, this was seen in 47% of initial access method attacks. The main defense against this cyber attack is for users to change their behavior to avoid this cyber attack, which traditional phishing protection methods do not work.

What is ClickFix?

Microsoft has been tracking ClickFix attempts since early 2024. Recently, there has been an increase in this type of attack. It has become a widely adopted initial attack technique. It tries to trick or compromise users by getting them to launch malicious code.

ClickFix is a social engineering method that takes advantage of human nature to solve problems. It displays fake error messages, prompting users to copy and paste code or launch commands to fix a minor technical issue on their system.

According to Microsoft, ClickFix tricks users into copying a command (sometimes embedded in a fake pop-up, job application, or support message) and pasting it into the Windows Run dialog (Win + R) or Terminal.

Severity of the attack

The real goal of this tactic is to trick users into downloading malicious code. The pasted command executes PowerShell or mshta.exe, which directly loads malicious payloads into memory.

It is a 'clean, fileless process', which is often invisible to traditional security tools. According to Microsoft, ClickFix was the most common initial access method recorded through Microsoft Defender Expert Alerts last year, accounting for 47% of all attacks.

Clickfix techniques are being used by both cybercriminals and nation-state-level threat actors. Successful attacks have included payloads such as Lumma stealer, XWorm, AsyncRAT, VenomRAT, Danabot, and NetSupport RAT. Successful attacks have reportedly resulted in credential theft, malware staging, and persistent access using a few keystrokes on the user.

Security and Prevention

Microsoft recommends that users focus on behavioral changes to reduce the risk of Clickfix initial access attempts. Copying and pasting commands from any source, no matter how legitimate it may seem, can be just as dangerous as clicking on a suspicious link.

Microsoft also recommends implementing PowerShell logging to track potential ClickFix scams, monitoring clipboard-to-terminal activities, and using browser hardening and contextual detection systems to catch suspicious activity before the attack is successful.