Cybercriminals are increasingly using a social engineering attack called ClickFix, which manipulates victims into unknowingly initiating cyberattacks on their own systems. According to Microsoft’s 2025 Digital Defense Report, ClickFix has become the most common initial access technique, recorded in 47% of attacks tracked by Microsoft Defender Experts over the past year. This rise is largely attributed to attackers’ growing ability to bypass traditional anti-phishing protections and successfully exploit human behavior.
What is ClickFix?
ClickFix is a deceptive tactic that capitalizes on users' desire to solve perceived simple technical problems. It typically starts with a phishing email or fraudulent website designed to look like a legitimate service—one notable example was seen in spoofed Booking.com emails during the 2024 holiday season.
The victim is prompted through a fake notification to resolve an issue, often by copying and pasting a code snippet or clicking through a sequence mimicking technical support instructions. Unbeknownst to the user, these instructions result in executing malicious PowerShell or mshta.exe commands, which launch malware directly into system memory—bypassing the need for a downloaded file and evading common antivirus solutions.
Changing threat landscape
ClickFix is especially concerning because it reflects a broader shift in cybercriminal tactics: exploiting human psychology over technical vulnerabilities. Security vendors highlight that this trend is amplified by the use of artificial intelligence, which enables attackers to craft highly convincing phishing lures and even simulate full conversation threads for business email compromise schemes.
The payloads delivered through ClickFix attacks are diverse and dangerous, including ransomware, information stealers, remote access trojans (RATs), and worms such as Xorm, Danabot, and NetSupport RAT. Reports from security vendors indicate a 500% surge in ClickFix incidents in the first half of 2025, making up an estimated 8% of all attacks during that period.
Defense strategies and user awareness
Traditional defenses based on blocking suspicious attachments, network traffic, or sender domains cannot reliably stop ClickFix. Instead, organizations and individuals must focus on behavioral change: never follow unsolicited technical instructions without independent verification, and always treat requests for manual intervention—like pasting unfamiliar code—with skepticism.
Security awareness training and updated incident response plans are crucial for combating this new wave of attacks. As threat actors continue to refine their methods, education and skepticism remain the frontline defenses against self-induced cyber threats.
