Understanding and Responding to ClickFix Scams
Written by Andrew Coultas, IT Cybersecurity, Umpqua Indian Development Corporation in General Articles
Date: 08/27/2026
Cybersecurity threats continue to evolve, and one rapidly growing tactic poses a significant risk to organizations: the ClickFix scam. Accounting for 47% of malware infections in July 2026, ClickFix has quickly become the second-most common entry vector behind traditional phishing emails. Security researchers have tracked a 500% increase in these attacks in less than a year, making it critical for all staff and IT support personnel to recognize how this threat operates and how to respond.
How the ClickFix Scam Works
ClickFix relies on social engineering rather than traditional software vulnerabilities. A user browsing a website, opening an email, or viewing a popup may encounter a message that mimics a standard technical error, a CAPTCHA human verification prompt, or a browser update request.
The prompt instructs the user to resolve the issue by pressing two keys on their keyboard simultaneously (such as Windows key + R to open the Run dialog), pasting the copied text, and pressing Enter.
Following these instructions does not resolve any technical issue. Instead, it executes a hidden command on the machine. Because the user manually inputs the command, no traditional file download occurs, and no suspicious link is clicked. The attack succeeds by disguising malicious execution as a helpful troubleshooting step.
What Happens Behind the Scenes
When a user executes the command, the attack leverages living-off-the-land binaries built into Windows, most commonly mshta.exe, powershell.exe, or cmd.exe. The initial command is typically obfuscated or Base64-encoded to obscure its intent.
Rather than containing the malware itself, the initial command silently contacts a remote server to download the actual payload. Depending on the attacker's objective, this payload may be an infostealer, a remote access trojan, or a ransomware precursor. The process occurs silently, and the fake prompt often closes or appears to resolve once execution completes.
After landing on the system, the payload typically establishes persistence to survive system reboots through scheduled tasks or registry run keys. It then attempts to communicate with a command-and-control server. If the payload is an infostealer, it immediately targets saved browser credentials, session cookies, and autofill data.
Essential Rules for All Employees
No legitimate website, application, or system will ever require a user to open a command prompt or Run dialog box to fix an error or verify identity.
If a pop-up or message asks for keyboard shortcuts and pasted commands to resolve an issue:
- Do not follow the instructions.
- Close the window immediately.
- Report the incident to IT right away.
When in doubt, always reach out to support. Asking a quick question is always better than dealing with the aftermath of a preventable incident.
Guidance for IT Support and Incident Triage
When an employee reports a suspicious prompt or displays symptoms during a routine support request, IT support staff should gather context immediately and perform preliminary checks before escalating.
Questions to Ask the User
- Confirm whether they pressed the Windows key + R or opened a Run or Terminal window.
- Ask if they pasted any text and pressed Enter.
- Request a description or screenshot of the prompt or website (such as a CAPTCHA or browser update message).
Preliminary Technical Checks
- Task Manager: Review the Processes tab for unfamiliar instances of powershell.exe, mshta.exe, or cmd.exe, especially those with running child processes or tasks not initiated by the user.
- Run Dialog History: Press Windows key + R to inspect the dropdown menu of recent commands. Note any suspicious commands, but do not re-run them.
- Network Activity: Open a command prompt and run netstat -ano to look for active outbound connections to unfamiliar IP addresses or non-standard ports.
- Persistence Mechanisms: Check the Startup folder and Task Scheduler for recently created items, particularly those with generic or randomized names.
- Browser History: Review the browser history to identify the origin site, but do not navigate to it.
Escalation and Containment Protocol
ClickFix incidents require immediate escalation to the cybersecurity team. Local remediation, running standard antivirus scans, or allowing the user to continue working on the machine is not sufficient, as session data or credentials may already be compromised.
ClickFix incidents require immediate escalation to the cybersecurity team. Local remediation, running standard antivirus scans, or allowing the user to continue working on the machine is not sufficient, as session data or credentials may already be compromised.
If a ClickFix command has been executed:
- Isolate the machine from the network immediately.
- Do not attempt to clean or remediate the machine locally.
- Document all statements from the user and technical observations from initial checks.
- Escalate the ticket directly to the cybersecurity team for further investigation into potential data exfiltration.
A false positive costs only a few minutes, but a missed ClickFix infection can cost significantly more.