ClickFix and fake CAPTCHA simulation
ClickFix attack simulation, safely inside the browser
ClickFix pages tell people to “verify they are human” by copying and running a command, so the victim installs the malware themselves. SecurityRing lets your employees meet that trick in a realistic phishing email, records who would have gone through with it, and teaches them on the spot. Nothing ever runs on their computer.
Simulated landing pageBrowser verification
Complete the verification check
Copy the verification token, paste it into the browser console below, then run the check.
SR-CHECK-7K2Q9XCopy tokenThis controlled check runs only inside the browser page.
The real attack
A fake check that makes the victim do the work
Microsoft Threat Intelligence describes ClickFix lures as fake CAPTCHA, human-verification or error pages that instruct visitors to paste a command into the Windows Run dialog, Windows Terminal or PowerShell. It reports lures arriving through phishing emails, malvertising and compromised websites, and payloads including the Lumma Stealer infostealer, with a macOS variant that uses Terminal.
How the simulation works
Same steps, harmless token
A phishing email
Build the email in the AI Builder or from a recommendation, with ClickFix as the interaction technique. Its link opens a simulated landing page.
A browser verification panel
“Complete the verification check”: the page shows a token such as SR-CHECK-…, a “Copy token” button and a “Browser verification console” with “Run verification check”. If the drafted page tells people to copy, paste or run a command in a terminal, PowerShell or the Run dialog, SecurityRing replaces that text with “Use the browser verification check above.”
Nothing leaves the page
The token is never an operating-system command, and the console is part of the web page. Its help text says: “This controlled check runs only inside the browser page.”
Recorded, then taught
SecurityRing records whether the employee copied the token and whether they completed the simulated run, then opens the training page with a short video of that email, its red flags highlighted, and a quiz.
What you see
Who would have run it
- ClickFix copies and ClickFix simulated runs in the campaign report, alongside clicks
- Per-person rows: “Copied ClickFix token” and “Ran simulated ClickFix step”
- Risk by department, location, seniority and manager, plus focused retests
- Download PPT, Download PDF or CSV
SecurityRing is a simulation and training platform. It does not detect or block ClickFix; that is the job of your endpoint and email security tools.
Launch in minutes
Four steps per campaign
Choose people
Everyone, chosen departments or named people from your roster.
Pick a recommended attack
Choose an idea recommended for your industry, tools and news, then click “Build this idea”.
Approve what AI built
The AI Builder drafts the email, landing page, lesson and quiz. Edit anything, then approve.
Schedule and launch
Optionally send yourself a test, set the delivery window and pace, and activate.
One-time setup: import your roster and have your email admin allowlist SecurityRing’s sender details (a ready-made request is in the app).
Is the ClickFix simulation safe?
Yes. The landing page shows a harmless token and a simulated console inside the browser page. The token is never an operating-system command, and nothing runs on the employee’s computer.
What does SecurityRing record?
Whether the employee copied the token and whether they completed the simulated run, alongside the usual click data. Reports show ClickFix copies and ClickFix simulated runs, and each person’s row shows the steps they took.
Does SecurityRing detect or block ClickFix attacks?
No. SecurityRing is a simulation and training platform. It helps employees recognise the technique; detection and blocking belong to your endpoint and email security tools.
Which channel does the ClickFix simulation use?
Email. The simulation is a phishing email whose link opens the fake browser-verification page. It is live today.
What happens after an employee completes the fake verification?
They go to the training page: a short video of the email they received with its red flags highlighted, and a quiz. It is designed to take under two minutes.
Sources and method
- Microsoft Threat Intelligence, “Think before you Click(Fix): Analyzing the ClickFix social engineering technique”, 21 August 2025. Accessed 15 October 2026.
The product flow above is described from SecurityRing’s landing-page renderer as of 15 October 2026.
Run a ClickFix simulation before attackers do
See the fake verification page, the report and the lesson in a demo.