ClickFix Technique Empowers Threat Actors to Take Full Control of Targeted Organizations

A new wave of sophisticated cyberattacks leveraging the “ClickFix” technique is providing threat actors with unprecedented capabilities to compromise a wide swath of organizations.

Throughout 2025, security researchers have observed an uptick in high-profile campaigns distributing NetSupport RAT, Latrodectus malware, and Lumma Stealer, all utilizing variants of ClickFix to gain initial access and establish persistence within enterprise environments.

ClickFix Technique Empowers Threat Actors

ClickFix is a deceptive social engineering method that exploits users’ trust in “quick fix” solutions for common computer problems.

Under the guise of addressing mundane issues like missing drivers or pop-up errors, threat actors instruct users to copy and execute malicious commands via the Windows Run dialog (Win+R) or a terminal session (Win+X).

These commands are often injected into the user’s clipboard by malicious JavaScript hosted on compromised websites, malvertising networks, fake tech support forums, or seemingly legitimate video tutorials a technique also dubbed “pastejacking.”

The superficial credibility of these lures is reinforced by impersonating trusted brands such as DocuSign and Okta, further obscuring the malicious intent and making detection more challenging for both users and security systems.

Researchers have documented how these attacks evade traditional security controls by bypassing the need for exploit delivery, malicious attachments, or phishing links.

Instead, the user is socially engineered into manually executing the attacker’s payload through trusted system interfaces.

This method not only complicates automated detection but also leaves telling forensic traces, such as entries in the Windows RunMRU registry or evidence of PowerShell sessions spawned via Win+X after clipboard pasting.

Full Control of Targeted Organizations

Several major malware families have integrated ClickFix into their delivery chains in 2025.

A NetSupport RAT campaign in May targeted sectors ranging from healthcare and legal services to telecommunications and mining, leveraging fake DocuSign and Okta pages to trick users into running obfuscated PowerShell commands.

These scripts typically download malicious loaders and RAT payloads, often masquerading as legitimate runtime dependencies.

Latrodectus operators have also evolved, using compromised websites and ClearFake infrastructure to inject PowerShell commands that ultimately deploy the malware through side-loaded DLLs.

Meanwhile, Lumma Stealer campaigns have expanded into IT, automotive, and energy sectors, employing unique MSHTA commands tied to individually tracked payloads, and using typosquatted domains that mimic legitimate IP logging services.

The impact of ClickFix campaigns is particularly alarming: initial access, credential theft, mail exfiltration, endpoint takeover, and even ransomware deployment.

Sectors affected include high technology, financial services, manufacturing, retail, government, and utilities.

Incident response teams, such as Palo Alto Networks’ Unit 42, report a notable rise in compromises initiated through ClickFix lures, underscoring the need for proactive defense.

Detection and mitigation strategies hinge on a combination of user awareness, endpoint monitoring, and forensic analysis.

Analysts are encouraged to monitor Windows event logs for suspicious process creation, scrutinize RunMRU registry artifacts for obfuscated or anomalous commands, and correlate clipboard activity with subsequent PowerShell or MSHTA executions.

Security solutions such as Advanced WildFire, Advanced URL Filtering, DNS Security, and endpoint detection and response platforms like Cortex XDR offer layered defenses, while ongoing user education remains critical in reducing the success of these social engineering attacks.

As the ClickFix phenomenon continues to proliferate and adapt, organizations must remain vigilant, combining technical controls with robust incident response and cyber hygiene practices to mitigate the risk of these highly effective social engineering campaigns.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates