ClickFix is a social engineering technique. It typically shows a popup over a webpage instructing the viewer to run a system command that will install malware. It often contains an instruction to open the Run dialog on Microsoft Windows using the ⊞ Win+R shortcut.
The first ClickFix version was discovered in October 2023.
According to Hudson Rock, ClickFix often forms a feedback loop, using credentials stolen by infostealers to compromise administrative accounts on legitimate websites and host new ClickFix lures. In July 2026, researchers detailed an incident where stolen WordPress credentials led to a ClickFix campaign on an Artlist subdomain using Polygon smart contracts (EtherHiding) for dynamic payload routing.
In March 2026, Apple added a mitigation to macOS to prevent ClickFix style attacks. In April, a modified variant using the applescript:// URI scheme to bypass the use of the Terminal application was found.
In October 2026, Google Chrome introduced a feature to send the clipboard contents to the Google Safe Browsing service, after removing personal data. If the service returns that the contents contain a ClickFix command, the browser will present a warning.
ClickFix was used in the 2026 ransomware attack on Berlin.
In 2026, the Dutch municipality of Epe was hacked through a ClickFix page, which then allowed attackers to escalate privileges using the badly secured break glass account.
{{cite web}}: CS1 maint: numeric names: authors list (link)