What is a ClickFix Attack? How It Works and How to Protect Your Business in 2026

ClickFix is a cyberattack technique that tricks an employee into running a malicious command on their own computer, using familiar prompts that look like a browser check, software update, document viewer, or CAPTCHA screen. No obvious attachment has to be opened. The dangerous step is the instruction to open a system tool, paste a command, and press Enter.

Security researchers have tracked rapid growth in this tactic since late 2023. Proofpoint reporting found ClickFix campaigns rising sharply in 2025, while public threat reporting has tied the method to fake CAPTCHA pages, fake Windows Update screens, infostealers, remote access tools, and nation-state activity. For business owners, the lesson is simple: the attack does not need to break Windows if it can convince a trusted employee to run the command.

This guide explains what ClickFix is, how the attack works step by step, which businesses are being targeted, and what actually reduces risk. It also links the issue to practical controls covered in Cybersecurity Services, Microsoft 365 security checks, and the security stack overview.

What is ClickFix?

The name comes from the idea of clicking or following a quick fix for a fake technical problem. The user sees a message that feels routine: a file cannot display, a browser needs verification, a CAPTCHA needs one more step, or an update must be completed. The page then gives instructions that look like a support workflow but actually launch the attack.

The technique is powerful because it uses tools already present on the computer. On Windows, that commonly means the Run dialog, PowerShell, Windows Terminal, or File Explorer. On macOS, related campaigns have used Terminal-style instructions and later variants that tried to bypass user warnings. The common thread is not a software exploit. It is a persuasive instruction that gets the victim to execute the payload.

How does a ClickFix attack work?

Why does ClickFix bypass normal awareness training?

Most awareness training tells staff not to open strange attachments, not to click suspicious links, and not to enter passwords on unknown pages. Those lessons still matter, but ClickFix uses a different path. The decisive step is not a download button. It is a prompt that asks the employee to perform a short system action.

That is why ClickFix can work even in teams that have completed standard phishing training. The employee may not feel they are installing anything. They feel they are clearing a verification screen or fixing a document issue. Training needs to name this exact pattern: no legitimate website, CAPTCHA, update page, or document viewer should ask staff to open Run, Terminal, PowerShell, Windows Terminal, or File Explorer and paste a command.

What does a ClickFix popup look like?

Which industries are being targeted by ClickFix attacks?

Attackers adapt the fake prompt to the workflow the target already trusts. That makes ClickFix especially dangerous for businesses where staff regularly open client files, supplier portals, booking systems, invoices, or compliance platforms.

Does antivirus stop ClickFix?

Traditional antivirus can miss ClickFix because the first malicious step may not look like a downloaded file. A legitimate user launches a legitimate tool. The suspicious behavior is the process chain: a browser page influences clipboard content, a system utility starts, PowerShell or another interpreter runs, and outbound traffic begins.

That does not make antivirus useless. It means antivirus alone is not the control to rely on. Businesses need endpoint controls that understand behavior, not only file signatures. They also need logging and response paths that can isolate a device quickly if suspicious command execution appears.

What actually protects a business against ClickFix?

• Behavioural endpoint detection that flags suspicious PowerShell, script, and process chains
• Security monitoring that reviews unusual command execution, outbound traffic, and endpoint alerts
• Application control or script restrictions where operationally practical
• Browser, DNS, and web filtering that reduce exposure to compromised or malicious pages
• Least-privilege user accounts so one successful command has less reach
• MFA and conditional access to limit credential reuse after an infostealer event
• Backups, recovery testing, and endpoint isolation procedures for rapid containment
• Specific awareness training that shows staff what fake CAPTCHA, fake update, and fake document prompts look like

What should business owners ask their IT provider?

Is your business protected against ClickFix?

BPro Technologies supports managed IT and cybersecurity reviews for businesses across Australia, New Zealand, the UK, the UAE, and other approved remote-first markets. ClickFix protection is not one tool. It is a combination of endpoint detection, monitoring, access control, web filtering, staff training, and response planning.

If you want to know whether your current setup would catch a ClickFix-style attack, start with a free security assessment. We can review endpoint coverage, Microsoft 365 exposure, account controls, backup readiness, and whether your staff training covers current social engineering patterns.