New ClickFix Campaign Uses Malicious Videos to Make Users Infect Themselves

A sophisticated ClickFix social engineering campaign has emerged featuring embedded instructional videos that guide victims through self-infection processes, marking a significant evolution in attack techniques.

Security researchers have identified this as potentially the most advanced ClickFix implementation observed to date, with threat actors dramatically improving the authenticity and effectiveness of their malicious web pages.

Advanced Social Engineering Tactics Leveraging Video Content

The latest ClickFix variant impersonates Cloudflare‘s bot verification system with unprecedented realism, incorporating an embedded video tutorial that demonstrates how victims should execute the malicious commands.

The fake verification page includes multiple psychological manipulation elements, such as countdown timers, real-time counters showing “users verified in the last hour,” and device-specific instructions that adapt based on the victim’s operating system.

In approximately 90% of observed cases, the malicious page automatically copies harmful code to the user’s clipboard via JavaScript, requiring only that the victim paste and execute the command.

This campaign primarily targets users through Google Search rather than traditional email vectors, with 4 in 5 intercepted ClickFix pages accessed through poisoned search results and malvertising campaigns.

Attackers exploit vulnerabilities in website hosting platforms and content management systems to compromise legitimate sites or create purpose-built malicious domains optimized for specific search terms.

By bypassing email-based security controls entirely, these attacks eliminate a critical detection layer that organizations typically rely upon.

Technical Analysis of Payload Evolution

The technical sophistication extends beyond the social engineering layer into the mechanisms for payload execution. While PowerShell and mshta remain the predominant attack vectors, threat actors increasingly abuse Living Off the Land Binaries (LOLBINs) across multiple operating systems.

A recent innovation, dubbed “cache smuggling,” combines ClickFix methodology with JavaScript that caches malicious files disguised as JPG images, enabling local execution without external PowerShell requests.

The user-initiated nature of ClickFix attacks presents unique detection challenges, as the code copying occurs within the browser sandbox, where traditional security tools lack visibility.

Standard mitigation approaches prove ineffective because ClickFix exploits user-gesture-initiated paste events that cannot be blocked at the host level via group policies or device settings.

According to Microsoft’s 2025 Digital Defense Report, ClickFix attacks accounted for 47% of all initial access methods observed over the past year, making it the most common compromise vector.

This attack evolution leaves endpoint detection and response systems as the sole defensive layer for most organizations, creating a dangerous single point of failure.

Security researchers recommend implementing browser-based detection capabilities to identify and block malicious copy-paste operations before payload execution, providing defense-in-depth protection regardless of the delivery channel or malware variant.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates