What is ClickFix? The attack your users run for the attacker.

How a ClickFix attack works

1. The user reaches a lure page. Through a phishing e-mail, a malicious ad, a search result or, very often, a legitimate website that was compromised and now injects a script.
2. The page shows a familiar obstacle. “Verify you are human”, “the document cannot be displayed”, “your browser needs an update”, “fix the microphone for this meeting”.
3. One click writes the payload to the clipboard. The page calls the clipboard API with a command such as a hidden PowerShell download cradle, an mshta URL or, on macOS, a curl … | sh line.
4. The user is told to paste it. Windows + R, Ctrl + V, Enter. Or Win + X and Terminal. Or the File Explorer address bar (FileFix), where the command hides behind a fake file path.
5. The command downloads the real payload. Typically an information stealer (Lumma-style), a remote-access tool or a loader. Session cookies and saved passwords leave within minutes.

The next stage is often not hosted on a normal server. Campaigns pull it from compromised sites, from paste services or from a public blockchain (EtherHiding), which makes takedowns slow.

Why traditional defences miss it

• E-mail security sees a link to a normal-looking page, often a real company’s site.
• URL reputation is late: lure domains rotate daily and compromised sites have years of good reputation.
• Download protection never triggers: nothing is downloaded by the browser.
• Endpoint tools see explorer.exe start PowerShell because the user typed into Run. Many detect the payload later; few have context about the web page that caused it.
• Awareness training helps, but the lures change wording every week and imitate trusted brands.

What you can do today

1. Tell users the one rule: no website ever needs you to paste into Run, a terminal or the File Explorer address bar. Our guide for users can be shared as is.
2. Reduce the blast radius on Windows: where nobody needs it, disable the Run dialog through Group Policy, apply PowerShell Constrained Language Mode and AppLocker / WDAC for unprivileged users, and block mshta.
3. Watch for the endpoint trace: the RunMRU registry key keeps what was typed in Run; PowerShell started by Explorer with hidden-window and download flags is a strong signal.
4. Stop it in the browser. The page has to write the command to the clipboard and show instructions. That is the earliest, cheapest point to intervene.

How ByteMantle breaks the chain

• Clipboard neutralisation. When a page writes a harmful command, ByteMantle replaces it with a harmless message. The user can follow every instruction and nothing runs.
• Broad command coverage. PowerShell cradles and obfuscation, Windows living-off-the-land binaries (mshta, rundll32, certutil, msiexec from URL and more), macOS curl / osascript chains and Linux pipes to shell.
• Lure detection. Fake checks and “press Windows + R” instructions are recognised on the page, while real checks (reCAPTCHA, hCaptcha, Turnstile) are left alone.
• The full story in the console. For each incident: where the user came from (web mail, search, another site), the redirects, the compromised site’s script that loaded the lure, the command and the outcome. Block the site on the browsers you choose and forward the event to your SIEM.

See ClickFix & FileFix protection for the full list of command families.

Questions people ask

What is the difference between ClickFix and FileFix?

ClickFix asks the user to paste into the Run dialog, PowerShell or Terminal. FileFix asks them to paste into the File Explorer address bar, where the command is padded so that it looks like a file path. Both start with a page writing a command to the clipboard.

Which malware is delivered through ClickFix?

Mostly information stealers that take passwords, cookies and crypto wallets, and remote-access tools. Both state-backed groups and criminal campaigns use the technique.

Does disabling the Run dialog stop ClickFix?

It removes one path. Attackers switch to Terminal, PowerShell, File Explorer or macOS Terminal, so it should be combined with a control that stops the command at the source.

Is Chrome’s new ClickFix warning enough?

It is a welcome layer for people who turned on Enhanced Protection. We compare the two approaches in Chrome’s ClickFix warning vs a security extension.