What is a ClickFix attack?

A social-engineering technique in which a fake CAPTCHA, human-verification or error page tells the visitor to copy a command and run it, for example in the Windows Run dialog, Terminal or PowerShell. The victim installs the malware themselves.

How do ClickFix lures reach employees?

Microsoft reports phishing emails, malvertising and compromised websites as delivery routes.

Can you simulate ClickFix safely?

Yes. SecurityRing's ClickFix simulation uses a harmless token and a console that exists only inside the browser page. Nothing runs on the employee's computer; SecurityRing records whether they copied the token and completed the simulated run, then shows a short lesson.

ClickFix attacks explained: real examples and how to train employees

How ClickFix fake-CAPTCHA attacks trick people into running malware themselves, what Microsoft has observed, and how to train employees with a safe simulation.

By Sajjan Kumar Jain, founder of SecurityRing.ai · 15 October 2026 · 2 min read

Most phishing training teaches people not to click links or open attachments. ClickFix gets around that habit by asking the victim to do something that feels like a routine check: copy a line of text and paste it somewhere. This post sets out what Microsoft Threat Intelligence has published about the technique and how to train for it. We describe SecurityRing's ClickFix simulation last.

Anatomy of a ClickFix attack

According to Microsoft's analysis of 21 August 2025:

The visitor lands on a page that shows a fake CAPTCHA, a "verify you are human" step or a fake error.
The page copies a malicious command to the clipboard, usually without telling the visitor.
Instructions tell them to open the Windows Run dialog (Windows + R), Windows Terminal or PowerShell, paste and press Enter.
The command downloads and runs the payload. Because the user runs it, the attack can get past protections that look for automatic downloads.

Microsoft says it first observed the technique between March and June 2024, including in campaigns by the group it tracks as Storm-1607 delivering DarkGate. It describes "campaigns targeting thousands of enterprise and end-user devices globally every day".

What Microsoft has seen delivered

Routes: phishing emails, malvertising and drive-by compromises of legitimate websites.
Payloads: infostealers including Lumma Stealer, remote access tools and loaders.
Platforms: Windows, plus a macOS variant that tells the user to paste a command into Terminal and delivers the Atomic macOS Stealer (AMOS).

Red flags to teach

A website, document or "IT check" asks you to press keyboard shortcuts and paste something.
Text is on your clipboard that you did not knowingly copy.
A CAPTCHA asks you to do anything other than click or pick images.
The instruction arrives with urgency: "verification required to view the document", "fix this error to continue".

Microsoft's recommendations include educating users to recognise the technique and making sure "users are aware of what they copy and paste". Technical controls such as restricting the Run dialog and PowerShell, which Microsoft also covers, belong to your IT and security teams.

How to train for it safely

Telling people about ClickFix helps. Practising the moment of the decision helps more, as long as nothing real can run. In SecurityRing:

Choose ClickFix as the interaction technique for an email simulation, built in the AI Builder or from a recommendation.
The link opens a page with a "Complete the verification check" panel: a token such as SR-CHECK-…, a "Copy token" button and a "Browser verification console".
The token is never an operating-system command, and the console is part of the web page ("This controlled check runs only inside the browser page"). If the drafted page tells people to run a command in a terminal or PowerShell, SecurityRing replaces that text with "Use the browser verification check above."
The report shows ClickFix copies and simulated runs, and each person's row shows "Copied ClickFix token" or "Ran simulated ClickFix step".
The employee lands on the training page: a video of the email they received with its red flags highlighted, and a quiz, in under two minutes.

SecurityRing does not detect or block ClickFix attacks. It helps your people recognise them before they paste.

Sources

Microsoft Threat Intelligence, Think before you Click(Fix): Analyzing the ClickFix social engineering technique, 21 August 2025. Accessed 15 October 2026.