Attackers have refined a cunning technique dubbed “ClickFix” that has surged since late 2023, now commandeering trusted websites to initiate enterprise intrusions—with no exploit, attachment, or file download needed. Security researchers warn this method sidesteps common defenses, requiring a fresh approach to protection. CTM360’s new global threat report details the rise of ClickFix from fringe tactic to mainstream threat.
What ClickFix Is and How It Operates
ClickFix begins innocently: a webpage claims there’s a problem—perhaps a verification failure, missing browser render, or low Mac storage—and offers a “fix.” The user is told to copy instructions to the clipboard, open a trusted system tool (like Terminal, PowerShell, or Run), paste the instructions, and hit Enter. The command runs via a native, signed program already present on the machine. Since everything is user-initiated and involves legitimately signed software, there’s no detectable exploit or file-based malware.
This attack vector now ranks as the top method for initial access in enterprise internal telemetry—Microsoft reported that in 2025, nearly half of initial-access cases investigated by its Defender Experts team originated from ClickFix, surpassing phishing attacks. Other vendors documented massive growth: a 517% increase in 2025, followed by another 108% between late 2025 and mid-2026.
Behind the Curtain: Infrastructure and Evasion
The architecture driving ClickFix is built for stealth and resilience. Compromised websites don’t host malicious domains directly. Instead, they reference a smart contract on the Polygon blockchain via script, which returns the current malicious “lure” hostname. Researchers observed the contract rotate hosts multiple times a day—showing how the attack evades takedown.
Targeting decisions happen server-side: the operator sees the visitor’s OS and version and chooses which landing page to serve. Windows is active, macOS versions are ready but held in reserve, and mobile is often ignored. Mechanisms are in place to mask the lure from repeat visitors or crawlers. This kind of dynamic targeting makes detection much harder.
Finally, payload delivery is gated based on detailed device identity. Hardware fingerprints—such as GUIDs, volume serials, BIOS detail, GPU, username—are embedded in requests. The attacker decides whether to serve the actual payload, or a benign version, based on environment. That means sandboxing or crawling a page often returns nothing of substance, fooling automated defenses.
The Role of WordPress and How Sites Get Compromised
WordPress sites are a frequent delivery point—not because they’re the only target, but because they offer real domains, valid certificates, and minimal monitoring. In deep analysis of one compromised WordPress host, researchers found the malicious loader wasn’t in themes or posts at all, but appended automatically to all PHP output, including HTML, feeds, and JSON responses. It came through a “must-use” plugin invisible to standard plugin lists. Multiple scripted admin accounts had also been added. Suppressing visible symptoms by removing scripts or deleting accounts doesn’t remove the core infection.
Why Traditional Defenses Are Failing
Blocklists and domain takedowns barely inconvenience ClickFix. Lure domains rotate so fast—via the smart contract—and because the compromised sites themselves remain intact, there’s nothing to “take down” at the source. Standard URL-or-domain blocking simply cannot keep pace.
User-interaction-based detections also break down. Because attackers rely on tricking users into copying and pasting commands, many defenses that examine downloads or attachments see nothing unusual. And the fingerprinting makes sandbox evasion possible: tools used for threat detection are likely to receive nothing malicious.
What Works: Mitigations That Still Hold Up
The report identifies four chokepoints every campaign passes through: the clipboard write, interpreter launch, interpreter’s internet access, and persistence or data exfiltration. Two of those are long underused—blocking clipboard-write in managed browsers and channeling script execution through authenticated proxies. Either measure alone can derail ClickFix across Windows, macOS, and Linux.
For end users, the biggest takeaway is simple: nothing legitimate ever asks you to copy something onto your clipboard and paste it into PowerShell, Terminal, Run, or similar tools. If a page requests that, it’s an attack.
The full CTM360 report unpacks the evolution of ClickFix and its variants like FileFix and CrashFix; presents lure templates for Windows and macOS; maps the WordPress delivery chain; includes samples showing Vidar Stealer dropping payloads; and provides mitigation strategies for all major platforms.
Analysis:ClickFix represents a paradigm shift in initial access techniques. It doesn’t exploit software vulnerabilities, dodge firewalls, or rely on downloadable files—it abuses user trust and native system tools instead. As defenses scramble to adapt, organizations must rethink what “safe behavior” means online. Relying on traditional blocklists or attachment scans is increasingly inadequate. The real change lies in enforcing restrictions on what an interactive user can do—especially around clipboard operations, interpreter use, and the origins of browser-serve prompts. Expect attackers to push harder, rotate faster, and target broader platforms. The question isn’t whether you’ll encounter ClickFix—it’s when.
