ClickFix

ClickFix is a social-engineering malware delivery technique and mature Malware-as-a-Service ecosystem that tricks victims into manually executing attacker-supplied commands on their own systems. It commonly presents fake CAPTCHA checks, Cloudflare verification pages, browser or operating system update prompts, meeting errors, SSL warnings, or job-interview themed lures. The lure page typically uses JavaScript to place a malicious command into the victim’s clipboard, then instructs the user to paste and run it in Windows Run, Windows Terminal, or macOS Terminal. Rather than relying on software exploitation, ClickFix abuses trusted user actions and legitimate system tools to initiate compromise.

ClickFix campaigns are used to deliver a wide range of payloads, especially infostealers and remote access trojans. Frequently reported payloads include Lumma Stealer, DarkGate, XWorm, AsyncRAT, NetSupport, SectopRAT, CastleLoader-delivered RATs, and other post-exploitation implants. Observed infection chains often execute largely in memory and abuse signed or native binaries such as PowerShell, mshta, curl, rundll32, finger, tar, cmd, and other living-off-the-land tools to reduce detection. Some campaigns also use DLL sideloading, shellcode loaders, Python runtimes, Tor-routed communications, blockchain-based configuration retrieval, and API-driven backends that generate unique obfuscated commands per victim.

The ecosystem has industrialized since first emerging in 2024. Underground ClickFix kits have been sold with prebuilt lure templates, payload integration, domain rotation, malvertising support, and operator support channels. Researchers have documented multi-operator backend infrastructure, antivirus-evasion claims, and delivery workflows tailored by operating system and language. Related variants and adjacent tradecraft include CrashFix, FileFix, PromptFix, ConsentFix, and ClickFake Interview.

Delivery has been observed through compromised websites used as watering holes, poisoned WordPress and Ghost CMS sites, phishing and fake job-interview workflows, malvertising, SEO poisoning, and fake software or browser update pages. Threat actors ranging from commodity cybercriminals to state-linked groups have incorporated ClickFix into operations. Public reporting has linked ClickFix-style campaigns to APT28, MuddyWater, Kimsuky, and North Korean Contagious Interview activity, while financially motivated actors have used it to broaden initial access and malware deployment.

ClickFix targets both Windows and macOS users. On Windows, campaigns commonly lead to credential theft, session theft, persistence, reconnaissance, lateral movement, and broader post-exploitation through RAT payloads. On macOS, ClickFix-style delivery has been used to deploy infostealers that harvest validated login passwords, browser credentials, cookies, crypto-wallet data, Keychain contents, and password-manager material, sometimes using coercive forced-interaction techniques to obtain user secrets. ClickFix is best understood not as a single malware family but as a scalable operator-driven delivery framework for initial access and follow-on malware execution.