The PolySwarm Blog

Verticals Targeted: Government, Financial Services, Education, Transportation, Cryptocurrency, Enterprise Environments
Regions Targeted: North America, Europe, Middle East

Executive Summary

ClickFix has evolved from fake CAPTCHA and technical support lures into a broader family of attacks that manipulate trusted intermediaries to cross security boundaries. Based on publicly documented campaigns and independent vendor research, we assess that the most significant evolution is the diversification of trusted workflows being abused rather than the proliferation of named variants. The ClickFix family now spans execution, workflow and identity-focused techniques, demonstrating a flexible methodology adaptable to both cybercriminal and state-sponsored operations while challenging defenders to prioritize behavioral detection over individual malware families.

Key Takeaways

• ClickFix has evolved into a broader family of techniques that manipulate trusted workflows and intermediaries rather than relying solely on software vulnerabilities or traditional malware delivery.
• Variants including FileFix, CrashFix, InstallFix and ConsentFix demonstrate an evolution from user-mediated code execution toward workflow abuse and identity compromise, while PromptFix research suggests future attacks may target AI agents.
• Documented campaigns span multiple regions and industries, indicating the technique is broadly adaptable and reflects the objectives of the threat actor rather than a specific victim profile.
• Defenders should increasingly prioritize identifying trusted-workflow abuse and shared behavioral patterns rather than individual ClickFix implementations, malware families, or infrastructure.

Background

ClickFix should increasingly be viewed as a broader trusted-intermediary framework rather than solely as a technique involving fake CAPTCHA pages and Windows Run. The emergence of multiple independently documented *Fix techniques demonstrates sustained experimentation with the same underlying behavioral principle: manipulating a trusted intermediary into performing an action that transfers attacker-controlled instructions, artifacts, or authorization across a security boundary.

The most significant evolution is therefore not the growing number of names attached to ClickFix-related activity, but the diversification of the trust mechanisms being exploited:

• FileFix and TerminalFix modify where malicious commands are executed.
• DownloadFix demonstrates that the behavioral model may operate without clipboard manipulation.
• CrashFix and GlitchFix manufacture observable technical failures before presenting malicious remediation.
• InstallFix embeds malicious commands into workflows where command execution is already expected.
• ConsentFix extends the behavioral model beyond endpoint compromise into identity authorization.
• PromptFix research demonstrates how similar trust-manipulation concepts could eventually be applied to AI-powered agents.

This progression reflects an evolution from user-mediated execution toward trusted-workflow abuse, in which the attacker increasingly relies on legitimate users, applications, or authorization processes to perform actions that software alone cannot. Consequently, future ClickFix-derived or conceptually related techniques will likely continue targeting workflows in which humans or autonomous systems routinely execute commands, approve requests, authorize access, or transfer information between otherwise separated security contexts.

From ClickFix to the *Fix Family

Microsoft describes ClickFix as a social engineering technique that tricks users into executing attacker-controlled commands by exploiting their tendency to resolve apparently benign technical problems such as CAPTCHA verification, browser errors, or document access issues. Typical campaigns instruct victims to copy, paste, and execute malicious commands using trusted operating system interfaces including Windows Run, Windows Terminal, and PowerShell. Since early 2024, Microsoft has observed ClickFix campaigns targeting thousands of enterprise and consumer devices globally each day across numerous industries.

The widespread adoption of ClickFix by financially motivated and state-sponsored threat actors has encouraged continued experimentation with the underlying behavioral model. However, techniques grouped under the broader *Fix naming convention do not all represent the same type of evolution. Some modify the execution surface, while others manufacture convincing technical failures, abuse legitimate workflows, manipulate identity authorization, or explore how similar concepts could apply to autonomous AI systems.

As the ClickFix ecosystem has expanded, vendors and independent researchers have documented a growing collection of operational techniques, proof-of-concepts, and conceptual extensions. Existing research generally discusses these techniques individually or collectively as members of the broader *Fix family, despite representing different stages of maturity and different aspects of the attack lifecycle.

The following table summarizes the publicly documented ClickFix-related techniques identified to date and the primary innovation associated with each.

ClickFix: Establishing the Trusted-Intermediary Model

Traditional ClickFix establishes the behavioral foundation upon which subsequent *Fix techniques build. Rather than exploiting a software vulnerability, attackers manipulate users into transferring attacker-controlled instructions from an untrusted source, such as a webpage, into a trusted operating system interface where they are executed.

Microsoft has documented ClickFix campaigns delivered through phishing emails, compromised websites, malvertising, fake CAPTCHA pages, and malicious documents. Victims are instructed to execute commands using Windows Run, PowerShell, Windows Terminal, or macOS Terminal, demonstrating that the technique is independent of any single operating system or utility. Microsoft has also observed ClickFix campaigns targeting thousands of enterprise and consumer devices globally each day.

ClickFix's primary innovation was not its use of PowerShell or Windows Run, but its abuse of the user as a trusted intermediary capable of bridging otherwise separate security contexts through seemingly legitimate troubleshooting actions. This behavioral principle underpins every subsequent technique discussed in this report.

FileFix: Moving Execution into a Trusted Interface

FileFix represents one of the clearest mechanical evolutions of ClickFix. Security researcher mr.d0x introduced the technique in June 2025 as a proof of concept demonstrating that Windows File Explorer's address bar could serve as an execution surface. Within weeks, Check Point Research observed threat actors testing FileFix in operational infrastructure, with later campaigns incorporating malware delivery.

Instead of directing victims to Windows Run, FileFix instructs them to paste what appears to be a legitimate file path into File Explorer. The clipboard instead contains attacker-controlled content, shifting execution from Windows Run to File Explorer. Because interacting with File Explorer is a routine Windows activity, the technique may appear less suspicious to users.

Huntress also found that FileFix can produce forensic artifacts different from traditional ClickFix implementations. While Windows Run activity may populate the RunMRU registry key, FileFix can instead generate artifacts in TypedPaths. These artifacts are implementation-dependent and should not be considered universal indicators. Rather than fundamentally changing the attack, FileFix shifts the same behavioral model into an interface users already trust and use routinely.

FileFix (Part 2): Exploring Browser Security Boundaries

Following the original FileFix research, mr.d0x published FileFix (Part 2), examining how browser save behavior and Mark-of-the-Web (MOTW) protections could influence trusted-workflow abuse.

The research demonstrated scenarios in which attacker-controlled HTML and HTA content could be saved locally under conditions where expected MOTW protections might not be applied as defenders anticipate, highlighting the interaction between browser download behavior and Windows execution.

Unlike FileFix itself, FileFix (Part 2) was presented as security research rather than a new operational technique. Instead, it illustrates how trusted-workflow abuse could extend beyond operating system execution into browser-mediated security controls.

TerminalFix: Reducing the Execution Chain

TerminalFix represents another execution-focused evolution of ClickFix. Rather than directing victims to Windows Run or disguising execution as file navigation, it instructs them to open PowerShell or another terminal application and execute attacker-controlled clipboard content directly.

Huntress documented TerminalFix campaigns capable of detecting the victim's operating system and dynamically presenting separate instructions for Windows PowerShell, or macOS Terminal, demonstrating that the technique readily adapts across platforms. By eliminating intermediary launch mechanisms, TerminalFix can produce simpler execution chains than some traditional ClickFix implementations. However, resulting telemetry remains implementation-dependent and varies according to the commands executed.

TerminalFix reflects a broader trend within the ClickFix family: attackers increasingly simplify user interaction by leveraging workflows where command-line execution is already familiar. This approach is particularly relevant as software installation, administrative tasks, and AI-assisted development continue to normalize copying and executing terminal commands.

DownloadFix: Eliminating Clipboard Manipulation

DownloadFix represents a more significant conceptual departure because it demonstrates that clipboard manipulation is not fundamental to the underlying behavioral model. In the proof-of-concept analyzed by Huntress, a victim initiates what appears to be a normal file download. The webpage deliberately simulates a download failure before presenting a supposed repair utility, implemented as a .cmd file, which the victim is instructed to execute. Rather than instructing victims to paste commands, DownloadFix delivers a malicious repair artifact for the victim to execute.

Importantly, Huntress explicitly described DownloadFix as a proof-of-concept demonstrating behavioral evolution rather than an established operational technique. The demonstration used calc.exe as the payload to illustrate execution rather than malware delivery. Because DownloadFix removes one of the most recognizable characteristics of traditional ClickFix - the malicious clipboard - it provides an important analytical observation.

The defining characteristic of the ClickFix family is not clipboard manipulation itself, but rather the manipulation of a trusted intermediary into performing an attacker-controlled action. If future operational variants adopt similar approaches, defenders focused exclusively on clipboard activity may overlook techniques that preserve the same behavioral model while using entirely different delivery mechanisms.

CrashFix: Manufacturing the Problem Before Providing the Solution

CrashFix represents a significant evolution of ClickFix by creating the technical problem before presenting the solution. Rather than asking victims to trust a fabricated error, the attacker deliberately generates observable browser instability that reinforces the social engineering pretext.

Microsoft documented CrashFix in January 2026 as a malicious browser extension masquerading as uBlock Origin Lite. Once installed, the extension destabilized the victim's browser using an infinite JavaScript loop before displaying a fake security warning instructing the user to execute attacker-controlled commands. The campaign deployed ModeloRAT, a Python-based remote access Trojan, and performed host reconnaissance, with additional payloads observed on some domain-joined systems.

Unlike traditional ClickFix, which relies on a claimed technical problem, CrashFix manufactures evidence that remediation is necessary. By creating the condition it later "fixes," the attacker substantially increases the credibility of the social engineering pretext. CrashFix demonstrates a notable shift within the ClickFix family: innovation is increasingly focused on strengthening the justification for user action rather than changing the execution mechanism itself.

GlitchFix: Manufacturing Visible Browser Dysfunction

GlitchFix applies the same behavioral concept as CrashFix at the webpage and traffic-distribution level. Censys documented the ErrTraffic traffic distribution system (TDS), which intentionally manipulates webpage content to create visible dysfunction before presenting fake browser updates or remediation instructions. Observed functionality included replacing readable text with corrupted characters, distorting layouts, modifying cursor behavior, and making webpages appear broken while preserving the attacker's instructions. ErrTraffic supports Windows, macOS, Android, and Linux payload delivery and includes multilingual lures, geographic filtering, bot detection, and campaign analytics.

Unlike CrashFix, which creates instability through a malicious browser extension, GlitchFix manipulates the victim's perception of the webpage itself. In both cases, the attacker manufactures convincing evidence that remediation is required before directing the victim to perform a trusted action. CrashFix and GlitchFix represent a distinct branch within the ClickFix family. Rather than changing how commands execute, they strengthen the social engineering aspect by making the underlying problem appear genuine.

JackFix: Increasing Psychological Pressure

JackFix evolves the persuasion layer rather than the execution mechanism. Acronis documented JackFix campaigns that lure victims through fake adult-content websites before transitioning into highly realistic full-screen Windows Update or Windows Security interfaces. These interfaces attempt to limit normal browser navigation while presenting urgent remediation instructions that ultimately direct victims toward ClickFix-style command execution.

The campaign combines several reinforcing psychological pressures:

• Exposure to an apparently unsafe website
• A familiar Windows interface
• Apparently mandatory security remediation
• Reduced opportunities for normal navigation or dismissal

Despite these enhancements, the underlying execution workflow remains broadly consistent with conventional ClickFix activity. For this reason, JackFix is best understood as a high-pressure lure variant rather than a fundamentally new execution technique. This distinction illustrates why organizing variants solely by name can obscure the more meaningful behavioral evolution occurring underneath.

InstallFix: Hijacking Legitimate Administrative Workflows

InstallFix represents one of the most significant evolutions of the ClickFix family because it eliminates the need to fabricate a technical problem. Push Security documented campaigns using cloned installation pages for legitimate command-line software, including Claude Code, where attackers replaced legitimate installation commands with malicious substitutes. Instead of presenting fake errors or CAPTCHA challenges, the attack embeds malicious commands directly within a workflow users already expect to perform.

This approach is particularly relevant as command-line installation procedures become increasingly common among developers, system administrators, and users of AI-assisted development tools. Unlike traditional ClickFix, InstallFix does not persuade victims to perform an unusual action. Instead, it exploits an existing trusted workflow, making malicious instructions difficult to distinguish from legitimate documentation, developer resources, and AI-generated installation guidance.

ConsentFix: Extending the Model Beyond Endpoint Execution

ConsentFix demonstrates that ClickFix principles can extend beyond malware execution into identity compromise. Push Security introduced the term after observing attacks abusing Microsoft's OAuth authorization workflow. Rather than convincing victims to execute commands locally, attackers manipulate them into transferring authorization information that allows completion of an OAuth flow using Azure CLI.

Unlike traditional credential phishing, the attack does not require password theft or conventional MFA bypass. Instead, the victim transfers authorization material between trusted security contexts, shifting the attack from endpoint execution to identity infrastructure while preserving the same underlying trusted-intermediary model. ConsentFix demonstrates that the ClickFix family is better understood as a framework for abusing trusted intermediaries than as merely a malware-delivery technique.

PromptFix: A Conceptual Extension Toward AI-Assisted Workflows

PromptFix differs from the other techniques discussed in this report because it represents a research-demonstrated concept rather than an established operational variant. Guardio introduced the concept while evaluating security weaknesses in agentic AI browsers. The research demonstrated that fake CAPTCHA-style webpages could contain hidden instructions designed to influence AI agents, illustrating how an agent could interpret attacker-controlled instructions as legitimate actions required to complete a user's task.

Unlike ClickFix or ConsentFix, PromptFix does not target endpoint execution or identity authorization. Instead, it explores how the same trust-manipulation principles could apply to autonomous agents as they gain authority to browse websites, authenticate to services and perform delegated actions. PromptFix illustrates that the defining characteristic of the ClickFix family is not PowerShell, Windows Run, or malware execution, but the manipulation of a trusted intermediary capable of crossing a security boundary. As AI agents assume greater responsibility for user workflows, they may become another trusted intermediary susceptible to similar techniques.

Targeting Trends

Although ClickFix-related campaigns now operate globally, available reporting demonstrates that adoption patterns differ substantially between financially motivated cybercrime and state-sponsored operations. Understanding those targeting trends provides additional context for how the family is being operationalized across different threat actor communities.

Public reporting indicates that ClickFix-derived techniques have been adopted by a diverse range of financially motivated and state-sponsored threat actors. Unlike malware families developed for a specific mission set or victim population, the ClickFix family has demonstrated broad adaptability across geographic regions, industries and operational objectives.

Microsoft has reported observing ClickFix campaigns targeting thousands of enterprise and consumer devices globally each day across numerous industries. At the same time, individual campaigns continue to reflect the strategic priorities of the actors employing the technique rather than any inherent targeting preference within ClickFix itself. This activity demonstrates that ClickFix is best understood as a flexible initial access and trust-manipulation methodology, not a threat targeting a particular vertical.

Nevertheless, several geographic and sectoral patterns recur across publicly documented campaigns. Publicly documented campaigns have targeted organizations across North America, Europe, and the Middle East. Reported sectors include government, financial services, education, transportation and logistics, cryptocurrency-related users, and enterprise environments. Based on publicly documented campaigns, we assess that the ClickFix family does not currently demonstrate a consistent preference for any single geographic region or industry. Instead, targeting appears to reflect the operational objectives of the actors adopting the methodology. Consequently, defenders should view ClickFix as a delivery and trust-manipulation methodology capable of supporting a wide variety of intrusion objectives rather than a threat associated with any particular victim profile.

Evolution of the Trusted-Intermediary Model

The ClickFix family has evolved along multiple independent paths rather than a single linear progression. Early variants primarily modified where attacker-controlled commands executed (FileFix, TerminalFix, and DownloadFix). Later variants focused on increasing the credibility of the social engineering pretext by manufacturing observable technical failures (CrashFix and GlitchFix). More recent techniques exploit legitimate workflows (InstallFix), extend the behavioral model into identity authorization (ConsentFix), or explore how similar trust-manipulation principles could apply to autonomous AI agents (PromptFix). Despite these differences, each variant manipulates a trusted intermediary to cross a security boundary.

Across every documented branch of the family, one characteristic remains consistent. The attacker identifies a trusted intermediary capable of performing an action within a privileged context and manipulates that intermediary into performing the action on the attacker's behalf.

The intermediary may be:

• A human user
• A trusted operating system interface
• A software installation workflow
• An OAuth authorization process
• Potentially, an autonomous AI agent

Analyst Commentary

Traditional detection strategies emphasize malware families, payloads, infrastructure, and indicators of compromise. While these remain valuable, they are inherently transient. Malware evolves, infrastructure changes, and social engineering lures are continually refined. The ClickFix family illustrates this particularly well. Across documented variants, adversaries have modified execution surfaces, delivery mechanisms, social engineering pretexts, and even the security boundary being crossed, from Windows Run to File Explorer, from fabricated browser errors to manufactured failures, and from endpoint execution to OAuth authorization. Yet the underlying principle has remained consistent: manipulating a trusted intermediary to perform an action the attacker cannot, or would prefer not to, perform directly.

This distinction has important defensive implications. Organizations focused solely on identifying individual ClickFix implementations will continue to encounter new variants that appear technically different while preserving the same behavioral architecture. Defenders that instead recognize abuse of trusted workflows are better positioned to identify emerging techniques before standardized names or signatures exist.

This perspective also highlights the value of correlating intelligence across campaigns. PolySwarm provides access to a large corpus of malware samples enriched with multi-engine verdicts, malware family identification, and optional behavioral sandbox analysis. Correlating this data across campaigns can help analysts identify relationships that are not apparent from indicators of compromise alone.

Ultimately, the long-term significance of ClickFix extends beyond fake CAPTCHA pages. It reflects a broader adversarial strategy centered on manipulating trusted intermediaries to cross security boundaries. Historically, that intermediary has been the human user. Increasingly, it may also include trusted applications, delegated authorization workflows, and autonomous AI agents.

Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.

Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.