What is “ClickFix” and How Does It Work?

ClickFix is a social engineering tactic where attackers trick users into unknowingly running malicious code on their own machines such as Lumma and many more famous stealers. Instead of using automated exploits, or crafting malicious spear-phishing artefacts, ClickFix scams present fake error messages or “verification” pop-ups that instruct the user to perform a series of steps – typically copying and pasting a provided command into Windows and executing it. In essence, the victim “clicks to fix” a non-existent problem such as a captcha to prove themselves as human, but actually launches malware.

This technique emerged in 2024 and has been adopted by multiple threat actors in phishing campaigns and website compromises. It’s effectively a “self-pwn” method: the attacker convinces the user to infect their own PC under the guise of fixing an issue.

How ClickFix works :

• Fake Error or Verification Prompt: The user visits a malicious or compromised site and is greeted by a pop-up or page saying something went wrong (e.g. “Connection failed” or “Verify you are human”). It looks legitimate – mimicking a CAPTCHA, browser error, or software message – to lower suspicion.
• Clicking “Fix” or “Verify”: The user is prompted to click a button (often labeled “How to Fix” or “Verify”). Once clicked, the website copies a hidden PowerShell script into the user’s clipboard (this can be done via scripts on the page). The user may see instructions pop up, guiding them through the next steps.
• Pasting the Malicious Command: The instructions will say to open a console – either the Windows Run dialog (opened with Win + R) or a PowerShell/Command Prompt window – and press Ctrl + V to paste the copied content. Since the user clicked the fix button, the clipboard now contains an obfuscated PowerShell command prepared by the attacker.
• Executing the Payload: Finally, the user is told to press Enter to “complete” the fix. Doing so executes the pasted PowerShell command on their system. That command then reaches out to download malware from a remote server and runs it. In just a few steps, the victim has unknowingly launched the attacker’s payload on their own device.

Silent Infiltration: Using a School Website to Launch Malware

Recently, we hunted a website belonging to an educational institution in India was hacked to serve a ClickFix attack. A legitimate looking site was initially registered, which looked exactly similar to the original educational institutution’s website, then this fake domain was injected with malicious code that turned it into a trap for visitors which forces the users to solve a CAPTCHA . Instead of the normal content, users might encounter a page error or verification prompt as described above.

Behind the scenes, the attackers embedded an obfuscated PowerShell script into the site’s HTML/JavaScript. This hidden script was crafted to construct a remote URL and execute whatever content was hosted there – all in memory, leaving minimal traces. In this incident, the malicious script assembled a URL pointing to hxxps://alababababa[.]cloud/cVGvQio6.txt

This strange-looking address was not something the average user would notice, but it’s the source from which the second-stage payload would be pulled.

Infrastructure Behind the Attack

Although the IP address is geo-located to Saudi Arabia, it is registered under AEZA-AS, a Russian hosting provider.

Protecting Yourself: How to Avoid the ClickFix Trap

Don’t Trust Unexpected Fix Instructions

Be highly suspicious if a website or app suddenly asks you to open the Run dialog or console and paste code. Legitimate websites never require you to run PowerShell to fix an error or verify identity.

Watch for Suspicious Behavior

Fake CAPTCHA dialogs, browser errors, or “You need to verify…” messages are common in ClickFix attacks. Pay attention to:

• Poor grammar
• Unusual instructions
• Overly technical prompts for simple actions

Conclusion

This incident shows how attackers are now targeting public websites and innocent entities of education sectors such as students and aluminis, not just shady corners of the web. This is a reminder that cyberattacks are an everyday threat, and awareness must be constant.

ClickFix is one of the easiest ways for attackers to manipulate users into becoming part of their malware distribution chain. Without any exploits or advanced hacking, they convince people to run the attack themselves unknowingly helping spread malware with a single copy-paste.

Stay cautious. Stay curious. And never run code you don’t fully understand, no matter how convincing the message looks.