Your security stack does a lot of things well. It filters email, inspects network traffic, and watches endpoints for malicious behavior. ClickFix is dangerous precisely because it sidesteps all of that: not by defeating those tools, but by routing around the layer they were built to watch.
In 2025, ClickFix became the single most common way attackers got in. Below is what the technique is, why well-built tools struggle to stop it, and where prevention actually has to happen.
A ClickFix attack is a social-engineering technique that tricks users into running a malicious command themselves by disguising the instruction as a routine browser step, such as a fake CAPTCHA, a Cloudflare verification screen, or a browser error. The user believes they are completing a normal verification; in reality, they are executing the attacker's payload by hand.
The technique has moved from novelty to dominant entry point. Microsoft's 2025 Digital Defense Report identified ClickFix as the number-one initial access method of the year, responsible for 47% of observed initial compromises, ahead of traditional phishing (Source: Microsoft Digital Defense Report, 2025). ESET measured a 517% surge in ClickFix detections in the first half of 2025 alone (Source: ESET H1 2025 Threat Report).
A ClickFix attack works by turning the user into the execution mechanism: the malicious page silently copies a command into the clipboard, then instructs the user to paste and run it. By the time anything executes, it looks like a person voluntarily using a normal Windows tool.
The sequence is deceptively simple:
No malicious file is written to disk, and the payload is often generated uniquely on each visit (server-side polymorphism), so there is no consistent signature to match. As Menlo's 2026 State of Browser Security Threat Report documents, the entire chain is built from legitimate system actions, which is exactly what makes it so hard to catch.
Traditional tools struggle with ClickFix because there is no malicious artifact for them to find: no file to scan, no known-bad domain to block, and no abnormal process to flag. Each control is doing its job correctly; the attack simply doesn't appear where that control is looking.
FileFix is a 2025 evolution of ClickFix that achieves the same outcome through a different interface: the Windows File Explorer address bar instead of the Run dialog. It matters because it shows why blocking any single entry point is not a durable fix.
The threat group Interlock adopted FileFix to reach users who had been trained to distrust the Run dialog but had no reason to question a prompt inside File Explorer's familiar context, according to Menlo's 2026 State of Browser Security Threat Report. The common thread across ClickFix, FileFix, and whatever comes next is not the specific interface. It's the underlying strategy of using the user as the execution mechanism. Prevention that targets one interface will always be one variant behind.
You prevent ClickFix by stopping the attack at the browser session layer, before the malicious page can inject a command or convince the user to run it, rather than relying on the endpoint to catch the command after the fact. By the time the payload reaches PowerShell, every signal looks legitimate; the place to intervene is the page itself.
Two browser-layer controls close the gap:
This is prevention at the session layer, before content reaches the device. It's the browser-first defense model that Menlo's 2026 State of Browser Security Threat Report lays out across the full attack chain. It addresses ClickFix, FileFix, and future variants the same way, because it intervenes at the delivery point they all share rather than the interface each one happens to abuse.
Is ClickFix a virus or malware? ClickFix is not malware itself. It is a social-engineering delivery technique that tricks users into running malware on their own devices. The payload it delivers (often an infostealer or a remote-access tool) is the malware; ClickFix is the method that gets it executed.
Can EDR or antivirus detect ClickFix? Often not reliably, because there is no malicious file on disk and the command runs through legitimate Windows processes the user launched themselves. From the endpoint's perspective, a person opened PowerShell normally, which is why detection frequently arrives only after the payload has run.
What is the difference between ClickFix and FileFix? ClickFix typically routes the user through the Windows Run dialog (Win+R), while FileFix uses the Windows File Explorer address bar. Both produce the same result, a user-executed malicious command, but FileFix targets an interface that security training has rarely addressed.
Does disabling the Windows Run dialog stop ClickFix? It offers limited, temporary protection. Attackers shift to other legitimate interfaces (as FileFix demonstrates), so endpoint-level blocking becomes a game of catch-up. Durable prevention happens at the browser session layer, where the lure is delivered.
Sameep Gidda is a Digital Marketing Campaigns Specialist at Menlo Security. Focused on GEO strategy, content marketing, and AI visibility, Sameep works to ensure Menlo's expertise in browser security and agentic AI reaches the security professionals who need it most.
Menlo Security
