The Verification Step That Isn't One: How ClickFix Works and What Stops It

Every person online has clicked a CAPTCHA without thinking twice. That box asking you to prove you're human has become so automatic that most people finish it in under two seconds and move on with their day.

Attackers noticed. Over the past two years, security researchers around the world have tracked a technique called ClickFix, which dresses up a malware installation as a routine verification step. Instead of picking out traffic lights or bicycles, the fake CAPTCHA asks the visitor to open a system dialog and paste in a short line of text. That single paste runs a command that hands control of the device to an attacker. No download required. No suspicious attachment involved. The technique is common enough now that MITRE added it to its ATT&CK framework in March 2025 as its own catalogued method, tracked as T1204.004.

The Center for Internet Security (CIS), the nonprofit that runs threat monitoring for U.S. state and local governments through its MS-ISAC program, put its finger on exactly why it works: the technique "exploits users' familiarity with completing CAPTCHAs and other verification prompts, and it is designed to bypass defenses by tricking users into running malicious shell scripts themselves." In the first half of 2025 alone, CIS found that ClickFix accounted for more than a third of all non-malware alerts across the government network-monitoring service it operates.

A Technique Moving From Nation-States To Everyday Websites

Ukraine's national cyber response team, CERT-UA, recently attributed a wave of ClickFix attacks to Sandworm, a hacking group tied to Russia's military intelligence service. Investigators traced the campaign to more than a dozen legitimate Ukrainian websites that Sandworm had compromised, each one quietly serving the fake verification prompt to anyone who visited during June and July.

This attack didn't stay limited to one country, one type of target, or one operating system. Malwarebytes reported in May 2026 that hackers had taken over more than 700 education and technology websites to show the same fake CAPTCHA trick. CIS has also found similar versions called FileFix and TerminalFix. These swap out the Windows Run box for the Mac Finder or a Linux command line instead, but they all rely on the same trick: getting someone to "just fix the error" without thinking. What started as a spy tool is now common enough that any company, in any industry, using any type of computer, should expect an employee to run into it eventually.

Why This Particular Trick Works So Well

Bruce Schneier, a security technologist and lecturer at the Harvard Kennedy School, wrote one of the most cited lines in the field twenty-five years ago: "Only amateurs attack machines; professionals target people." ClickFix is a modern proof of that idea. It skips firewalls, antivirus software, and email filters entirely, and goes straight for the two seconds of trust built into a routine most people complete without reading the screen.

Years of legitimate CAPTCHAs trained everyone to click fast and move on, and that habit is exactly what ClickFix borrows.

The Detail That Gives It Away, And Why It Isn't The Whole Answer

A CAPTCHA never asks a visitor to open a terminal or the Windows Run dialog and execute a command. That single fact is worth teaching every employee. But treating it as a permanent fix would be a mistake: researchers have already documented ClickFix variants that ask victims to type a few characters instead of paste, specifically to dodge clipboard-monitoring defenses. The rule that will still hold up as attackers keep adapting is broader: no legitimate verification step ever asks a person to run a command at all, typed or pasted.That distinction matters because how training is delivered determines whether it works. Carnegie Mellon University ran one of the more rigorous tests of this, in a field study still cited across security research today: a 515-person experiment called PhishGuru that sent simulated phishing emails to students, faculty, and staff over 28 days.

Employees who received a short lesson immediately after clicking a test link were far less likely to click a similar link a month later, 23.8%, compared with 44.2% among employees who received no training at all. Those same employees clicked and responded to legitimate company announcements at the same rate as people who'd never been trained, so the lesson sharpened judgment without making anyone warier of email in general.

The researchers summed up their own findings this way: "Our findings suggest that security researchers and practitioners should implement user training as a complementary strategy to other technological solutions for security problems." That's the split this piece follows too: training sharpens judgment, and the controls below handle what judgment alone can't.

System-Level Controls Worth Building In

CIS recommends a few specific changes for this exact attack.

• Lock down PowerShell, the command tool built into Windows, so it only runs scripts that come from a verified, trusted source rather than something an employee just pasted in. Regular employee accounts shouldn't be able to open PowerShell at all, and starting it should require admin-level login credentials.
  
• The same kind of lockdown should apply to other command-line tools on the computer, and every script that does run should be logged, so a security team has a record to check even if something slipped through.
  
• Security teams can also set up their monitoring software to catch the giveaway pattern this attack always leaves behind, no matter what device it's on: a browser or email program suddenly opening a command tool and feeding it a long, scrambled instruction. That behavior looks nothing like normal computer use, and security software can be set up to flag it automatically, whether a person clicked something or not.

None of this depends on an employee noticing anything was wrong. It works in the background either way.

What Training Adds That Controls Can't

Technical controls and trained employees catch different things, and a company needs both. Controls quietly stop attempts before anyone sees them. Training changes what happens in the moments controls don't: how fast someone notices something is wrong and tells their security team.

Verizon's 2025 Data Breach Investigations Report found that employees with recent security training reported suspicious emails about four times more often than employees without it: roughly 21% compared to about 5%. That gap, the time between an attacker's first foothold and a security team's first alert, is exactly what training is built to close. A slide watched once a year won't produce that kind of gap. Practice against a specific, current version of a trick will.

A Habit Worth Building Together

Controls and trained instincts both point toward the same habit: pause before running anything a pop-up tells you to run, and flag it the moment something feels off. Speed favors the attacker, and a quick report closes that gap fast. Teams that treat a fast report as a win build the habit faster than teams that treat it as a slip-up to hide.

Building that habit works best as a partnership between a security team and every person carrying a laptop, paired with the system-level controls that catch what training alone will miss. Adaptive Security's simulations are built to give employees practice against the specific version of this trick circulating right now, so the recognition and reporting side of that partnership keeps pace with how the attacks change.

The internet will keep asking people to prove they're human. The goal is making sure that whenever a hacker asks the same question with a different motive, both the person on the keyboard and the systems behind them already know the difference.