Social engineering appeals to people’s better nature, and cybercriminals know this. That’s why it’s still one of the most widely used attacker tactics. And one specific technique is becoming more and more widespread, according to the EU’s cybersecurity agency.
ENISA’s Threat Landscape 2026 report highlighted the growing use of ClickFix during 2025. Used by ransomware affiliates and state-aligned actors alike, ClickFix manipulates people into taking an unsafe action. It commonly appears as a browser error, software repair message, or fake ‘prove you are human’ check like the kind we see online all the time. The attacker persuades people to run harmful instructions while believing they are fixing a technical problem. What feels like routine troubleshooting actually runs a malicious command.
As ENISA summed up, the growing use of this tactic shows “a broader shift towards techniques designed to further capitalise on abusing trust rather than technical weaknesses alone”.
The human factor… again
After working in enterprise architecture many years ago, I moved into a cyber role, and nothing’s changed: the human is still a major point of entry for attackers.
There’s extensive evidence to show that social engineering remains the single leading human risk in cybersecurity. As well as ENISA’s report, benchmark industry research like the SANS Security Awareness Report and the Verizon Data Breach Investigations Report support this.
ClickFix borrows from the same playbook, by directly targeting human psychology. It first emerged in mid 2024, and instances rose significantly in 2025 and 2026. Security researchers at Proofpoint and Microsoft, among others, have documented extensive ClickFix campaigns.
The tactic taps into people’s innate wish to trust others, and weaponises our natural inclination to want to solve problems, along with a helping of deference to authority. If we think the order is coming from someone in a senior position, we do as we’re told.
Timing can play a part as well. During the pandemic, I started to notice a pattern of breaches happening towards the end of the working week. This makes sense for attackers to try to exploit people when they’re tired, distracted or multitasking, while also wanting to respond promptly to what appear to be urgent messages. We all have busy lives, trying to juggle different commitments; it only takes a moment of inattention to let our guard down.
How ClickFix works
ClickFix differs from traditional phishing attempts that trick users into clicking malicious links or opening compromised attachments. Instead, it manipulates the user into executing the payload directly.
It often starts with someone following an email link, clicking an advert or visiting a compromised website. A convincing message interrupts them, claiming that a page can’t load, a browser needs fixing or an identity check must be completed.
Attackers present official-looking pop-up messages or fake CAPTCHA prompts that instruct users to copy and paste malicious commands directly into core system utilities like PowerShell or Windows Run, and hit ‘enter’. Some versions direct macOS or Linux users to a terminal, a window used to give the computer written instructions. Other variants use the File Explorer address bar or offer a supposed repair download.
Organisational and personal risks
The threat from ClickFix applies to all industry sectors and organisations of any size. Once an attacker tricks a user into pasting and executing a command, they gain remote device access and elevated system privileges. From this foothold, threat actors can harvest credentials, move laterally through networks, and reach an organisation’s ‘crown jewels’: the data and sensitive information that’s unique to the business.
There’s usually a strong financial element to the threat. A ClickFix attack can ultimately lead to the victim’s sensitive information being exfiltrated or blocked, and the attacker can then threaten the victim with deleting this data, disclosing it, or selling it on the dark web.
Sometimes, attackers will threaten to lock the victim out of its systems or block access to data, applying pressure because the businesses are effectively unable to operate as normal. In other cases, beyond threatening businesses, threat actors may harass individual employees using spyware claims or personal blackmail demands.
I have seen instances firsthand where an individual was able to safely report that something strange had happened that impacted on their computer and that vigilance saved their organisation from suffering a similar fate.
How to mitigate the threat from ClickFix
As the risk from ClickFix increases, multiple layers of defence are still key to keeping the threat at bay. When it comes to attacks with a strong social engineering component, I believe training is essential for end users and for security teams.
Awareness training needs to build in practical examples. Show people what a fake CAPTCHA, browser error message or repair prompt looks like; help them to recognise suspicious instructions. Employees play an important role in detection. A website asking someone to paste commands into a system tool to prove they are human or fix a browsing problem is a warning sign.
Staff also need to know that if something out of the ordinary happens, and if they get caught out by a ClickFix attack, they know where to report. It’s critical that there’s a no blame culture around reporting. I blogged about this recently. If people feel they can’t speak up after falling victim, they won’t report it.
Use the example of ClickFix to update security policies. Have a strict rule thatusers should never copy and paste unverified text or code into command-line utilities like PowerShell or Windows Run. Make people aware they need to take extra caution when they’re working to urgent deadlines, are multitasking, or handling messages late in the week.
Supporting the human with technical controls
Behind this layer, technical controls should minimise the burden on the end user: ideally there should be proactive detection that triggers alerts for suspicious behaviour event before someone reports it. The defences should restrict unnecessary command execution, strengthen protection for browsers, email and endpoints, and test detection.
Apply application controls and limit access to scripting tools according to job requirements. Consider disabling Windows Run where it’s not needed. Use managed browsers, malicious-site blocking, email link checking and endpoint detection and response tools. If the organisation uses macOS or Linux devices, make sure the coverage extends to those too.
These are just good asset management principles: organisations should know all of theoperating systems and software versions that are running in the business, so they know what countermeasures to take in the event of an incident. This can reduce delays in identifying and patching vulnerabilities promptly.
Practice resilience and response
Organisations need to update their incident response procedures to reflect the changing threats. I liken resilience against threats like ClickFix to standard health and safety practices. Just as companies conduct regular fire drills to help them react instinctively when an alarm sounds, businesses should conduct regular incident response tabletop exercises. This way, everyone knows their roles and what they need to do to contain a threat and recover from it.
I know from experience that if there isn’t a rigorous plan that’s been thoroughly tested, then people won’t know what to do in a stressful situation. This isn’t a question of budget. Businesses of any size can be resource constrained, but it doesn’t cost a lot of money to figure out processes and lines of communication during an incident. Having solid, tested procedures in place will minimise any risks and allow a business to keep operating and recover faster.
The best way to counter a threat that targets humans is by combining multi-layered technical detection with an informed, confident workforce. What goes for ClickFix is valid for many cybersecurity threats. Give people the tools they need to be an effective line of defence.
Sarah Hipkin is a Senior Consultant with BH Consulting.
