Affected Systems

All enterprise environments with Windows, macOS, and Linux endpoints. ClickFix is a social engineering technique that bypasses traditional security controls by tricking users into pasting malicious commands into trusted system interfaces (PowerShell, Terminal). CTM360 analysis of 17,000+ compromised URLs shows widespread adoption by cybercriminals and state-sponsored actors. No specific vendor or product vulnerability involved.

Exploitation Status

Actively exploited at scale. Microsoft attributed 47% of initial-access cases in 2025 to ClickFix. ESET reported 517% increase in first half of 2025 and additional 108% increase in first half of 2026. MITRE assigned sub-technique T1204.004 (User Execution: Malicious Copy and Paste) in March 2025. Over 3,000 URLs actively serving lures at time of CTM360 report publication.

Business Impact

ClickFix bypasses email gateways, endpoint detection, browser reputation checks, and sandbox analysis. Attack infrastructure uses blockchain (Polygon smart contracts via EtherHiding), Telegram channels, and Steam profiles for C2 resolution, making domain blocking ineffective. Lure domains rotate faster than blocklists can update. Server-side targeting delivers OS-specific payloads (Windows active, macOS and Linux ready) and suppresses malicious content for sandboxes and repeat visitors. Payloads are machine-fingerprinted (GUID, volume serial, BIOS, GPU, username) before delivery, rendering detonation-based analysis unreliable. No file-on-disk or exploit required—commands execute via signed system binaries by authenticated users, mimicking legitimate admin activity.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Implement endpoint detection rules for MITRE T1204.004 focusing on clipboard-to-PowerShell/Terminal execution patterns, especially base64-encoded commands and unusual parent-child process relationships involving wscript.exe, mshta.exe, or curl/wget.
  • Deploy browser isolation or content disarm and reconstruction (CDR) for external web traffic to prevent clipboard manipulation by untrusted sites.
  • Block or monitor outbound connections to blockchain RPC endpoints (Polygon, Ethereum) and social media API endpoints (Telegram, Steam) from workstations not requiring these services.
  • Conduct user awareness training specifically on ClickFix pretexts: fake CAPTCHA/verification pages, browser rendering errors, document open failures, and macOS disk-space warnings that request paste-and-execute actions.
  • Review EDR and sandbox configurations to ensure machine fingerprinting artifacts (generic hostnames, default GUIDs, VM indicators) are randomized or masked to improve payload retrieval in analysis environments.