.svg)
.svg)
.svg)
.svg)
.svg)
In July 2025 the FBI, CISA, HHS and MS-ISAC warned that a ransomware group was using a fake CAPTCHA that tells the visitor to open the Windows Run window and paste a command. These ClickFix attacks need no exploit, attachment or malicious link, only a person who follows instructions. This post is for SOC leads and security awareness managers in the UAE and GCC who want staff to recognize the lure and stop at the right step.
In short: in ClickFix attacks the victim runs the malicious command personally. The one habit that stops them is to never paste anything into Run, PowerShell or Terminal because a web page asked. Close the page and report it.
How ClickFix Attacks Work
A ClickFix page offers a small problem and a quick fix. The problem can be a CAPTCHA, a missing driver or a fake Blue Screen of Death, as the Cyber Security Agency of Singapore describes. The fix is to copy something, open a system tool and paste it.
In the fake CAPTCHA scam, the page puts a command on the clipboard and then asks the visitor to press Windows key + R, press Ctrl + V and press Enter, the sequence the University of Florida IT security team documents. On macOS the same trick sends the victim to Terminal. The text shown on the page can differ from the command that was actually copied.
The joint advisory on the Interlock ransomware group shows where that path ends: a Base64-encoded PowerShell process that the victim launched personally. Singapore's agency lists credential theft, data exfiltration, email account compromise and possible ransomware as outcomes.
Why a Fake CAPTCHA Scam Works
Most defenses look for what attackers usually need, such as a malicious attachment, a risky link or an exploit. Singapore's agency notes that ClickFix needs none of them and that the command runs through a trusted system shell, which makes detection harder. The final step happens in a window the employee opened on purpose.
The lure also fits ordinary working habits. Picture an accounts payable clerk whose invoice portal will not load on the day before a payment run. A page that promises a thirty-second fix is tempting, and a CAPTCHA is something people click through without a second thought.
That is why the human decision matters so much. The 2026 Verizon Data Breach Investigations Report found the human element present in 62% of the confirmed breaches it analyzed.
The One Habit That Stops It
The habit fits in one sentence. A website never needs you to open Run, PowerShell or Terminal and paste something. If a page says otherwise, close the tab and tell the security team.
It works because it does not depend on recognizing the brand, the wording or the malware family. Lures change and this step does not. The University of Florida guidance puts it as never pasting anything outside your browser when a website asks, and the joint advisory recommends training users to identify, avoid and report social engineering attempts.
Reporting is the second half of the habit. One person's near miss becomes a signal the SOC can act on, for example by checking who else visited the same page. Technical controls back the habit up, and Singapore's agency recommends the following.
- Monitor for malicious PowerShell activity with SIEM tools.
- Enforce least-privilege access.
- Use application allowlisting to block unapproved executables and scripts.
- Keep systems, software and anti-virus current.
ClickFix Awareness Training That Sticks
ClickFix awareness training has one job: make the refusal automatic at the moment of the prompt. A yearly slide about CAPTCHAs does not do that. Short lessons do, when they rehearse the real sequence: a fake check, then Windows key + R, then a paste.
Codex delivers this as agentic AI-driven micro-learning in Arabic and English. The lessons are bite-sized and built on real-world scenarios, and the agentic AI recommends or assigns them to each person from their training gaps and behavioral signals. Role-based learning paths let finance, HR and IT staff see the pretexts that fit their work.
Practice has to follow the lesson, and the email that sends people to a ClickFix page is ordinary phishing. Graybait runs that practice without campaigns, picking each employee's next simulation from their Human Risk Profile. When someone shows a risk, Zero-Touch Training responds with matched coaching in Microsoft Teams, with no manual step.
A related lure, device code phishing, asks for a different input, but the habit of stopping at an unusual request carries over.
What to Do After a Paste
Some staff will paste before they think, so the response needs to be as rehearsed as the refusal. The University of Florida guidance for a managed device gives three steps.
- Disconnect the device from the network.
- Stop using it, but do not shut it down or log off.
- Report it to IT at once.
Make reporting quick and free of blame. People who fear a reprimand stay quiet, and the SOC then learns about the incident from the malware instead of from the employee.
Make the Habit Automatic
Go back to the clerk with the portal that will not load. The goal is that the clerk closes the tab and reports it, because the rule is already part of how they work. Add the paste rule to your next awareness cycle, start with the roles that handle payments and admin access, and track how fast the first report arrives.
Frequently Asked Questions
What are ClickFix attacks?
ClickFix attacks are social engineering lures that show a fake problem, such as a CAPTCHA or an error screen, and tell the visitor to copy a command and run it. The victim opens Run, PowerShell or Terminal and pastes it. The malware then runs because the user launched it, not because of an exploit.
Is ClickFix phishing or malware?
ClickFix phishing is the delivery side: an email or web page that persuades someone to act. The malware arrives only after the victim pastes the command. Singapore's agency reports that phishing emails have redirected victims to these pages, so the first line of defense is still a person who recognizes the lure and reports it.
Does ClickFix affect Mac users?
Yes. The University of Florida describes a macOS version in which the page tells the victim to open Spotlight, launch Terminal and paste a copied command. The tool is different but the habit that stops it is the same: never paste into a system tool because a website asked, and report the page.
Which controls support staff against ClickFix?
Singapore's agency recommends SIEM monitoring for malicious PowerShell activity, least-privilege access, application allowlisting and current software and anti-virus. These controls limit what a pasted command can do. They work best beside a trained habit, because the employee is the one who decides whether to paste.
How should we train staff on ClickFix?
Use short lessons that show the real sequence and state one rule: never paste into Run, PowerShell or Terminal because a page asked. Deliver them in Arabic and English, tailor them to roles, and measure how often and how quickly staff report suspicious pages, not only whether they completed the lesson.
.png)
.png)
.png)
