Full Report
The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting
Analysis Summary
# Tool/Technique: ClickFix
## Overview
ClickFix is a highly effective social engineering technique used for initial access. It involves a deceptive web page that mimics a legitimate security check (e.g., "prove you are not a robot"). The attack trickery relies on user interaction to copy a malicious command to the system clipboard and manually execute it via a terminal, bypassing traditional email and file-based security controls.
## Technical Details
- **Type:** Technique / Social Engineering Vector
- **Platform:** Windows (primarily, via PowerShell/CMD), potentially cross-platform depending on the command payload.
- **Capabilities:** Bypasses email filters, avoids file-scanning engines, leverages human trust/compliance, and facilitates initial access.
- **First Seen:** Observed as a dominant vector in late 2024/2025 (Microsoft Digital Defense Report 2025).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (User-initiated command execution)
- T1059.001 - Command and Scripting Interpreter: PowerShell
- **TA0005 - Defense Evasion**
- T1115 - Clipboard Data (Abuse of clipboard for command staging)
## Functionality
### Core Capabilities
- **Clipboard Hijacking:** Automatically places a pre-formatted malicious command onto the user's clipboard while the user is distracted by "instructions" on a fake CAPTCHA page.
- **Human-Assisted Execution:** Guides the user through a series of steps: opening a terminal (Win+R or PowerShell) and pasting the command (Ctrl+V).
- **Scanner Evasion:** Since no malicious attachment is downloaded and no vulnerability is exploited, there is no file hash for AV to flag or CVE for EDR to block at the point of entry.
### Advanced Features
- **Social Engineering Playbooks:** Standardized templates that mimic legitimate services (like Google Chrome, Microsoft, or CAPTCHA services) to increase the success rate.
- **Living-off-the-Land (LotL) Integration:** Often used to trigger administrative binaries already present on the system to minimize the footprint.
## Indicators of Compromise
- **File Hashes:** Typically N/A for the initial vector (command-based).
- **File Names:** PowerShell.exe, Cmd.exe (abused for execution).
- **Registry Keys:** N/A for initial technique; specific to post-exploitation payloads.
- **Network Indicators:**
- `[fake-captcha-domain].com` (Defanged)
- `[attacker-controlled-shortener].io` (Defanged)
- **Behavioral Indicators:**
- Unexpected PowerShell or CMD execution initiated by a user following web browser activity.
- Commands containing `Invoke-Expression` (IEX) or encoded strings (`-enc`) pasted directly into the terminal.
## Associated Threat Actors
- **The Gentlemen** (Successor to Qilin affiliates)
- **Qilin** (Ransomware group)
- Observed in approximately 47% of Microsoft-notified incidents in the recent reporting period.
## Detection Methods
- **Behavioral Detection:** Monitor for instances where `PowerShell.exe` or `Cmd.exe` are spawned and receive long, complex, or obfuscated command lines shortly after a browser session.
- **Clipboard Monitoring:** EDR tools can be configured to flag when a browser process writes executable scripts (e.g., beginning with `powershell -e`) to the clipboard.
- **User Education:** Training users to recognize that legitimate CAPTCHAs or "robot tests" will never ask a user to open a terminal or paste commands.
## Mitigation Strategies
- **Attack Surface Reduction (ASR):** Implement rules to block process creation from Office or Browsers (though ClickFix relies on manual user execution, ASR can still limit the scope of the resulting shell).
- **PowerShell Constrained Language Mode:** Limits the types of commands that can be executed via the terminal.
- **Endpoint Hardening:** Disable or restrict terminal access for non-administrative users where possible.
## Related Tools/Techniques
- **Living-off-the-Land (LotL):** Used in 84% of high-severity incidents to avoid installing new malicious binaries.
- **Fake Update/Fake Browser Alerts:** A similar social engineering lure used to deliver payloads like SocGholish.