Do not become a ClickFix victim.
Republished on July 3 with reports into a new attack with a different twist.
There’s a new attack “taking the threat landscape by storm,” and it should have all PC users worried. “While virtually nonexistent a year ago,” this attack has surged to such an extent in recent months that it’s now second only to phishing on the danger list.
We’re talking so-called ClickFix attacks, in which you are tricked into hacking your own PC when you follow on-screen instructions to fix a technical issue, open a secure file or website, or prove your human through a popup CAPTCHA challenge.
The latest warning comes from ESET, which says in its new Threat Report that these attacks have now “skyrocketed.” That should maybe be no surprise, given the multiple warnings that have been issued in recent months.
But what should come as more of a surprise is that these attacks are still claiming countless victims, despite being so easy to detect and avoid — in theory at least.
ClickFix attack
ESET warns “payloads at the end of ClickFix attacks vary widely – from infostealers to ransomware and even to nation-state malware – making this a versatile and formidable threat.” It targets different operating systems, but this is really a Windows PC threat.
ClickFix always works by asking users to copy and paste text into a Run window, thus executing a script. That script can itself be dangerous, but more likely seems benign and actually downloads and runs the malicious script out of sight of the user.
2025 Threat Report
“By the end of 2024,” ESET says, “attacks using the same social engineering technique flooded the web. Threat actors have been creating fake websites mimicking popular services – such as Booking.com or Google Meet – compromising legitimate websites with fake browser update prompts, fake Cloudflare verifications or reCAPTCHA checks, and distributing links leading to ClickFix pages via email campaigns.”
ClickFix attack.
The ClickFix attack is just a shop window for multiple threats that will be installed on your device if you fall for that initial lure. “The list includes popular infostealers such as Lumma Stealer, VidarStealer, StealC, and Danabot; remote access trojans such as VenomRAT, AsyncRAT, and NetSupport RAT; remote monitoring and management tools such as MeshAgent; post-exploitation frameworks such as Havoc and Cobalt Strike; and cryptominers, loaders, clipboard hijackers, and much more.”
If you’re not worried yet, then you should be. These attacks are varying rapidly. Hackers are seeking out new lures and testing what works best. The capability is also being farmed out to multiple groups with different malware to deploy. Recent attacks have even “attempted to deploy Interlock (formerly Rhysida) ransomware.”
If you ever see a message — however worded — asking you to press the Windows Key + “R” and then “Ctrl+V” to paste and then “Enter,” then your PC is being hacked. Period.
Do none of those things. Escape or force exit the program. And then reboot your PC. If you think you have fallen into a ClickFix trap, run an antivirus scan on your PC and change all key account passwords. You should also check your financial accounts.
While ClickFix is synonymous with Windows, there’s now a timely reminder that Mac users are also vulnerable to these tactics — being tricked into running a script on your device that seems to do one thing, when it’s actually hacking you in the background.
SentinelOne warn that North Korean hackers have been caught targeting victims with various malware payloads, which are installed on machines after users run a script that purports to be a Zoom update ahead of joining a scheduled call.
“ClickFix” Zoom lure
“The attack chain begins with a now-familiar social engineering vector: impersonation of a trusted contact over Telegram and inviting the target to schedule a meeting via Calendly. The target is subsequently sent an email containing a Zoom meeting link and instructions to run a so-called ‘Zoom SDK update script’.”
While most ClickFix attacks are either wrapped in a tech support lure or a fake CAPTCHA challenge, we have seen multiple instances of users being asked to take actions to access a secure website or open a password protected document.
That fake Zoom script “ends with three lines of malicious code that retrieve and execute a second-stage script from a command-and-control server hosted at support.us05web-zoom[.]forum. This domain name format has been chosen for similarity to the legitimate Zoom meeting domain us05web.zoom[.]us.”
Once installed on the user’s Mac, the malware is designed to root our and steal credentials from Arc, Brave, Firefox, Google Chrome and Microsoft Edge browsers, again highlighting the vulnerability in saving passwords in browsers.
Beyond that, different malware payloads can be tasked with different outcomes. SentinelOne says this shows how threat actors will continually “introduce new levels of complexity for analysts.” As ever, the teams says, “in the cat-and-mouse game of threat and threat detection, when one side innovates, the other must respond.”
