ClickFix — the social engineering trick that gets you to paste a malicious command yourself — has leveled up. Way up.
Researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and found something new. The fake “prove you’re human” pages aren’t serving static malware anymore. They’re pulling freshly scrambled commands from API-driven backend servers on demand. He asked one server for 100 payloads and got 100 different ones, each wrapped in a different encryption layer — Base64, AES, TripleDES, Rijndael, Deflate.
Strip the wrapping and they all unpack to the same script. For now. Pals expects per-victim tailoring soon.
The platforms also serve lures in 25 languages and detect your OS — macOS versions run right alongside Windows ones.
ClickFix is simple by design. A booby-trapped page shows a fake CAPTCHA or error. Hidden JavaScript drops a command into your clipboard. The page tells you to press a key combo, paste, and hit Enter. You run the malware yourself. No exploit at the first step, often no file for antivirus to flag.
ESET measured a 517% jump from late 2024 into early 2025. Microsoft’s 2025 Digital Defense Report says ClickFix accounts for 47% of initial-access cases its Defender Experts team sees. The technique even has its own MITRE ATT&CK entry: T1204.004.
Pals also spotted a newer delivery method built to bypass Windows script scanning. Instead of putting the malicious command in the clipboard, the page quietly downloads a file to your Downloads folder. The clipboard gets a short orchestrator line that moves the file, unpacks it, and runs the script inside. Because the pasted line is just the orchestrator, it slides past AMSI. The bad code sits in the downloaded file, off to the side.
Execution has drifted toward stealth too. The original 2024 lure told people to press Windows+R and paste into the Run box. Newer versions point them to Windows+X and Terminal instead. Terminal use looks more ordinary, and unlike the Run box, it leaves no trace in the RunMRU registry key.
ClickFix isn’t just criminals anymore. Proofpoint tied state-backed groups from Russia, Iran, and North Korea — including APT28, MuddyWater, and Kimsuky — to ClickFix campaigns. North Korean crews built a fake-job “ClickFake Interview” version targeting crypto workers.
What should defenders watch? Process chains. Explorer.exe or WindowsTerminal.exe launching powershell.exe or cmd.exe and reaching out to the network right after. Pals also listed three payload servers seen during research: comicstar[.]lat, babybon[.]cfd, and merkantalolol[.]asia. A connection doesn’t prove infection — it means a command was likely placed in someone’s clipboard.
Pals’ verdict: “ClickFix is here to stay.” Every time defenders catch up, it shifts. The move from one-off scripts to on-demand payload servers is just the latest adaptation — and it keeps the whole operation cheap to run.
