What happened
ClickFix has grown from a simple social engineering technique into a mature malware ecosystem that is increasingly bypassing traditional endpoint security tools, according to new research from ReversingLabs.
First observed in 2024, ClickFix attacks rely on tricking users into copying and pasting malicious commands, often PowerShell commands, into their own systems after seeing fake browser errors, software updates, or CAPTCHA verification prompts. Because users execute the commands themselves using legitimate Windows tools, many antivirus (AV) and endpoint detection and response (EDR) products struggle to distinguish malicious activity from normal administrative tasks.
ReversingLabs researcher Toni Dujmović said the ClickFix ecosystem has become highly organized, with malware-as-a-service (MaaS) offerings, analytics-driven targeting, and rapidly changing infrastructure helping attackers evade detection. The company also found that ClickFix is no longer limited to credential theft. While Lumma Stealer remains a common payload, attackers are increasingly delivering remote access trojans (RATs) such as DarkGate, XWorm, AsyncRAT, NetSupport, and SectopRAT.
The report also highlights new variants, including CrashFix, identified by Microsoft in early 2026, along with other “Fix”-style attacks that target Windows File Explorer, AI tools, and OAuth authentication.
Who is affected
Any organization with employees using Windows endpoints is at risk, particularly those that rely heavily on user interaction with browsers, email, and collaboration platforms.
Because ClickFix exploits human behavior instead of software vulnerabilities, organizations across all industries can be targeted. Security teams that depend primarily on signature-based AV or EDR technologies may also have reduced visibility into these attacks, allowing threat actors to establish persistent access before suspicious activity is detected.
Why CISOs should care
ClickFix demonstrates how attackers are adapting to modern security controls by exploiting trusted user actions rather than relying on malware exploits alone.
ReversingLabs recommends shifting detection earlier in the attack chain by using structural YARA rules that analyze the HTML lure pages instead of chasing constantly changing payloads. According to the researchers, this approach successfully identified numerous ClickFix lures that had evaded conventional AV detection.
For CISOs, the findings reinforce that user awareness, endpoint hardening, and behavioral detection must work together. As ClickFix evolves into a broader malware delivery platform, organizations need layered defenses capable of identifying suspicious behavior before malicious commands are executed.
3 practical actions
- Deploy structural detection. Consider using YARA-based rules to detect ClickFix lure pages before users execute malicious commands.
- Harden Windows environments. Restrict PowerShell where appropriate, control the use of living-off-the-land binaries, and monitor for suspicious process behavior.
- Strengthen user awareness. Train employees to recognize fake browser updates, CAPTCHA requests, IT support messages, and other social engineering prompts.
