How CISOs can defend against ClickFix attacks

ClickFix attacks represent a significant and growing threat to enterprise security, combining social engineering with technical exploitation to compromise user systems and steal sensitive data.

Because these attacks bypass many traditional defenses, preventing them requires a layered approach. 

How the ClickFix attack chain works

A ClickFix attack begins when a user encounters a fake error message or CAPTCHA challenge. Attackers use multiple delivery methods to reach their targets and redirect them to fake error pages. Potential vectors include the following:

• Malvertising campaigns. Inject malicious ads into legitimate websites.
• Compromised websites. Redirect users to attacker-controlled pages.
• Phishing emails. Trick users into clicking malicious links.

In each of these attack vectors, fake error messages prompt users to click to "fix" an urgent problem with their devices, accounts or software. Users trust these messages because they mimic legitimate system dialogs they recognize. Clicking the button on a ClickFix prompt executes the attacker's payload.

The payload typically delivers a script that executes with user-level privileges, meaning the malware can access all data the user can access. For many workers, this includes emails, documents and credentials stored in browsers. The script might install remote access tools, information stealers or other malware.  

Why ClickFix attacks are increasing

ClickFix is an increasingly popular malware delivery method. That's at least partly because it bypasses many security controls, such as the following.

• Email filters miss phishing-based ClickFix messages that look authentic.
• Web-browsing controls allow access to legitimate websites that serve malicious ads.
• Browser security features focus on known threats, not those designed with convincing social engineering.

A ClickFix attack relies on human behavior. Rather than exploiting unpatched vulnerabilities, these attacks exploit users' trust in daily tools, such as Windows and browsers, and dialogs that appear to come from them.

How to build a ClickFix defense strategy

Because no single defense stops every ClickFix attack, CISOs need a layered defense-in-depth approach. Start with awareness training and endpoint detection and response (EDR), as these controls provide broad coverage at reasonable cost. Then consider email filtering, web filtering and managed browsers to reduce phishing vectors. Finally, monitor RunMRU for indicators of compromise and implement system dialog restrictions, provided they do not break business applications.

Update security awareness training

Train users to recognize fake error messages. Teach them to verify errors independently rather than clicking on error dialogs. Show real examples of fake CAPTCHA challenges. Remind users that legitimate system dialogs rarely ask for immediate action or urgent clicks. Conduct regular simulated phishing exercises to keep awareness high.

Deploy EDR

Deploy EDR across all endpoints to detect suspicious process execution and script activity. Many ClickFix payloads trigger EDR alerts due to unusual execution patterns. Monitor for scripts launched from browsers, particularly PowerShell commands executed by Explorer or browser processes.

Implement email and web filtering

Filter emails containing known phishing indicators. Block URLs pointing to known ClickFix campaigns. Implement URL rewriting to sandbox potentially malicious content. These controls reduce initial attack vectors, though sophisticated phishing campaigns could bypass them.

Consider enterprise-managed browsers

Consider enterprise-managed browsers for high-risk users. These browsers run in isolated containers and restrict script execution capabilities, preventing downloaded payloads from reaching the main system. However, they increase administrative overhead and might affect user productivity.

Monitor RunMRU for indicators of compromise

Attackers often use the Windows Run dialog (Win+R) to execute commands hidden from users by creating commands that outrun the command prompt dialog box. Many ClickFix payloads take advantage of this method. Monitor the RunMRU registry key, which logs recently executed commands. Look for suspicious PowerShell execution or downloaded files.

If appropriate and feasible in your environment, use Group Policy to restrict which users can access the Run dialog.

Restrict system dialogs

Configure Windows to restrict application-level dialogs that mimic system messages. Some organizations disable the ability to display dialog boxes from web browsers. Others enforce dialog verification through Group Policy. Test these restrictions carefully to avoid breaking legitimate applications.

ClickFix attacks succeed by exploiting human trust and technical capability. Defending requires both technical controls and an informed user base. By combining these approaches, CISOs can significantly reduce the risk that ClickFix attacks pose to their organizations.

Matthew Smith is a vCISO and management consultant specializing in cybersecurity risk management and AI.