Delivery technique · MITRE ATT&CK T1204.004

ClickFix (fake fix-it prompts)

Fake error or CAPTCHA pages that tell the victim to paste a command into their own computer, which installs malware.

How it works

1. A compromised or fake site shows a fake verification or error.
2. It copies a command to the clipboard and tells the user to paste and run it.
3. The user runs the attacker's code themselves.

Defenses

• Teach that no real website asks you to paste commands.
• Restrict the Run dialog and script interpreters for most users.
• Alert on clipboard-to-shell execution patterns.

Reference: Microsoft: Think before you ClickFix