ClickFix Turns Legitimate Websites and System Tools Into a Malware Delivery Chain

More than 17,000 URLs carried fake verification prompts

ClickFix has developed into a major initial-access technique by moving the decisive action away from a software exploit and onto the victim. Instead of silently compromising a browser, the attack persuades users to execute a command themselves.

CTM360’s investigations identified more than 17,000 infected URLs displaying fraudulent Cloudflare verification pages. About 3,000 were still delivering the lure when the analysis was prepared.

The pages present problems that appear plausible in context: a failed human-verification test, a browser rendering error, an inaccessible document or insufficient storage on a Mac. The visitor is then instructed to copy a command, open a system interface, paste the content and press Enter.

In some cases, the page places the command directly into the clipboard. The user subsequently runs it through a legitimate interface such as PowerShell, Terminal, the Windows Run dialog, a command prompt or File Explorer’s address bar.

That sequence is central to ClickFix’s effectiveness. An authenticated user launches a native, signed utility, allowing the operation to avoid security controls focused on malicious attachments, suspicious downloads or conventional browser exploits.

Microsoft attributed 47% of the initial-access incidents handled by its Defender Experts team in 2025 to ClickFix, putting the method ahead of conventional phishing in that dataset. ESET measured a 517% increase during the first half of 2025, followed by another 108% rise between the second half of 2025 and the first half of 2026.

MITRE added the behavior as T1204.004, User Execution: Malicious Copy and Paste, in March 2025. The technique is associated with Windows, macOS and Linux.

The attack targets behavior, not a vulnerable software version

ClickFix is not a software vulnerability. CTM360 assigned neither a CVE identifier nor a numerical severity score, and there are no affected product versions to patch.

For the same reason, treatment under CISA’s Known Exploited Vulnerabilities catalog is not applicable. There is no KEV remediation deadline because the attack does not depend on exploitation of a catalogued flaw.

The analyzed campaign was configured primarily for Windows, but that does not make ClickFix a Windows-only threat. Its server-side settings contained operational macOS lures, including a fake Apple support article claiming to help users resolve low disk space. A Linux delivery slot was also present, although it was empty in the examined configuration. Mobile delivery was disabled.

The operator could determine what each visitor saw after receiving the device’s operating system and version. Windows targets could receive one landing page, Mac users another, while mobile visitors could be shown nothing malicious.

Related approaches include FileFix and CrashFix. Across these variants, the interface and pretext may change, but the attack still depends on convincing the victim to transfer attacker-controlled instructions into a trusted local execution path.

Recent campaigns have also demonstrated how ClickFix can exploit trust outside ordinary compromised websites. A separate incident used a hijacked verified Reddit account to distribute ClickFix advertisements to Windows and macOS users.

Polygon, Telegram and Steam make blocking less reliable

The compromised-site script examined by CTM360 did not contain a fixed attacker-controlled domain. Instead, the victim’s browser sent a free, read-only request to a smart contract on the Polygon blockchain.

The contract returned an encoded value resolving to the current lure hostname. This process required no cryptocurrency wallet, payment or blockchain transaction from the visitor.

During one day of observation, the contract supplied three different lure hosts while the infected websites remained unchanged. By updating the on-chain value, the operator could redirect all participating sites to new infrastructure within seconds.

That design weakens domain-based blocking. Defenders may remove one lure hostname, but the compromised pages can obtain its replacement without requiring the attacker to modify each site again. Blocking the blockchain RPC services is also problematic because they are legitimate, shared infrastructure used by unrelated applications.

Other stages used different resolution channels. Telegram channel descriptions and a Steam profile page could disclose the malware’s current command-and-control address. Taking down one mechanism would therefore not necessarily disable the entire chain.

A traffic-distribution system added another layer of resilience. It polled the operator about every 1.5 seconds and could decide whether to display the malicious instructions or silently mark a visitor as verified.

Researchers, crawlers and automated sandboxes could receive clean content while selected targets saw the ClickFix overlay. A cookie then suppressed the overlay for repeat visitors for 90 days, further reducing the likelihood that a later inspection would reproduce the initial infection path.

Machine fingerprinting conceals the final payload

The recovered dropper included a base64-encoded machine fingerprint in its download path. The collected fields covered the machine GUID, volume serial number, computer name, BIOS manufacturer, system model, graphics processor and username.

This information allowed the command-and-control server to identify the requesting computer before releasing the next stage. The server could return a machine-specific payload, substitute different content or provide no payload at all.

A failed sandbox detonation therefore does not establish that a website is harmless. An automated environment and a genuine employee workstation may receive entirely different responses from the same address.

CTM360 conducted two independent investigations involving different hosts and methods. One could follow the operation only as far as the dropper because the subsequent delivery was fingerprint-gated.

The second traced the chain through three Telegram-based dead-drop resolvers and two AES decryption layers. It ultimately recovered Vidar Stealer, running inside a legitimately signed Microsoft binary through DLL side-loading.

DLL side-loading abuses the way an application searches for required libraries. A legitimate executable loads a malicious DLL placed where the program expects to find a dependency, giving the malware execution within the context of the trusted binary.

Both investigations exposed the same traffic-distribution API structure, which CTM360 considers evidence that they used a shared kit.

Sekoia’s June 2026 analysis of the ErrTraffic framework also connected the Polygon contract to an operator cluster reported to distribute Vidar exclusively. CTM360 rated that correlation with moderate confidence because the framework is sold to multiple affiliates for about $380 per month, allowing infrastructure and cluster boundaries to change.

The report additionally describes ClickFix as having state-sponsored users, but it does not identify a government or provide a specific state attribution.

WordPress compromise can survive superficial cleanup

WordPress sites provide useful delivery infrastructure because they combine established domains, valid certificates and genuine visitor traffic. They may also operate without the continuous monitoring applied to more sensitive corporate systems.

In the host-level investigation, PHP appended the malicious loader to every dynamic response examined. Identical content appeared in HTML pages, RSS feeds and JSON output.

That behavior pointed to a WordPress must-use plugin. Such plugins load automatically on every request and do not appear in the standard plugin list, making the implant easier to overlook during a routine administrative review.

Investigators also found roughly two dozen administrator accounts created by scripts. The combination of persistent server-side injection and numerous privileged accounts means that deleting a visible JavaScript block, removing spam pages or disabling one suspicious administrator would not fully remediate the site.

No WordPress vulnerability or affected WordPress version was identified. The findings describe compromised installations and persistence mechanisms, not exploitation of a disclosed WordPress CVE.

Administrators investigating similar behavior should review must-use plugins, server-side PHP modifications, unexpected administrator accounts and injected output across multiple response formats. Cleanup must address both the content injection and every route by which the attacker can regain access.

Defenders should interrupt the chain at its behavioral chokepoints

Fast-changing hostnames are poor primary indicators for this activity. CTM360 instead identifies four actions that every successful chain must complete: writing instructions to the clipboard, launching an interpreter, allowing that interpreter to reach the internet, and executing malware that persists, collects data or exfiltrates it.

Managed browsers can block clipboard writes by default. The lure may remain visible, but forcing a user to manually retype an obfuscated command adds friction and can stop the staging process.

Organizations can also route script interpreters and network-capable command-line utilities through an authenticated proxy. This can interrupt the first outbound request on Windows, macOS and Linux without depending on a current list of malicious domains.

Application controls should restrict what interactive users can launch and what trusted utilities can load. Monitoring should focus on unusual interpreter activity, unexpected outbound connections from native system tools, suspicious DLL loading and commands pasted into shells immediately after browser activity.

User training remains necessary. A legitimate verification page, document viewer, software update, video call or support article should not require someone to paste a website-provided command into PowerShell, Terminal, the Run dialog or another operating-system interface.

That single instruction is the exploit substitute. Preventing it—or detecting the execution that follows—offers a more durable defense than chasing infrastructure designed to disappear.