What is ClickFix?: Resources

Companion resources for What is ClickFix? Fake CAPTCHA Attacks Explained: how fake CAPTCHA and “fix it” lures trick users into pasting and running a malicious command, what attackers do next, and the defense layers that can break the chain.

Free one-page cheat sheet

The ClickFix attack flow (fake CAPTCHA → clipboard → Win+R → PowerShell → payload), key stats with sources, key terms (including ConsentFix and FileFix), a defense checklist for users and security teams, and clickable links to every chapter.

References & sources used in this video’s research

1. Microsoft Digital Defense Report 2025, Microsoft (2025). Used for: ClickFix accounted for 47% of initial-access attacks seen in Microsoft Defender Experts notifications, ahead of phishing at 35%. Cited in the video VO, YouTube description, and the cheat-sheet “47%” stat. Note: an alternate CDN path ending in Microsoft-Digital-Defense-Report-2025-v4-05Nov25.pdf also appears in research notes; both were treated as the same report. Live-fetch of the description URL was not re-checked in this draft pass.
2. CrowdStrike 2026 Global Threat Report, CrowdStrike (2026). Used for: fake CAPTCHA lure incidents up 563% in 2025. Cited in the video VO, YouTube description, and the cheat-sheet “563%” stat. Summary blog also referenced in research: crowdstrike.com blog findings.
3. ESET Threat Report H2 2025, ESET (2025). Used for: FakeCaptcha detections were more than 1.6 million in H1 2025 (December 2024 to May 2025), as reported when H2 detections fell from that H1 peak to under 60,000 after the Lumma Stealer takedown. Used for the cheat-sheet "1.6M+" stat. Period and figure: research brief [S6b].
4. Think before you Click(Fix): Analyzing the ClickFix social engineering technique, Microsoft Threat Intelligence (2025 (Aug 21)). Used for: how the clipboard / Run-dialog technique works; common payloads (e.g. Lumma Stealer, RATs). Verified live in Draper S2/S3/S4 notes (2026-11-03/04).
5. User Execution: Malicious Copy and Paste (T1204.004), MITRE ATT&CK (2025 (created Mar 18); v1.1 last modified May 12, 2026). Used for: classifying the core ClickFix behavior; “establish a foothold” wording. Verified live in Draper S2 notes.
6. #StopRansomware: Interlock (AA25-203A), CISA / FBI (et al.) (2025 (Jul 22)). Used for: ClickFix as an initial-access method used by the Interlock ransomware group; Win+R / Ctrl+V / Enter steps. Verified live in Draper S2/S4 notes.
7. Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape, Proofpoint (2024 (Nov 18)). Used for: early public naming of the technique; fake error / CAPTCHA lure patterns. Verified live in Draper S2 notes; shown on-screen as a reference card.
8. ConsentFix: Browser-native ClickFix hijacks OAuth grants, Push Security (2025). Used for: ConsentFix variant (OAuth / auth-code paste instead of malware). Also ConsentFix debrief. Listed in S2 research notes.
9. FileFix – A ClickFix Alternative, mr.d0x (2025). Used for: FileFix variant (paste into the File Explorer address bar). Listed in S2/S3 research notes.
10. Threat Detection Report: Initial Access (“Paste and run away”), Red Canary (2025). Used for: observed ClickFix payloads (LummaC2 / Lumma, Vidar as publicly reported, Stealc). Listed in S3/S4 research notes.
11. A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor, Mandiant / Google Threat Intelligence (2025 (Aug 20)). Used for: access-as-a-service / selling access to affiliates after ClickFix footholds (UNC5518). Listed in S4 research notes. Flag: the post does not say “underground criminal forums”; the cheat sheet and resource page follow the hedged “access sold to other criminal groups” wording.
12. Our latest defenses against evolving web scams, Google / Chrome (Jasika Bawa) (2026 (Oct 20)). Used for: Chrome Enhanced Protection warning when a suspicious ClickFix-style command is copied. Verified live in Draper S5 notes.
13. Attack surface reduction rules reference, Microsoft Learn (Defender for Endpoint) (n.d. (current page)). Used for: ASR rules as an execution-prevention control in the defense section.
14. Policy CSP ADMX_StartMenu — Remove Run menu from Start Menu (NoRun), Microsoft Learn (n.d. (current page)). Used for: example of restricting the Windows Run dialog (Win+R). Microsoft notes it does not block all other ways to run programs.
15. ClickFix: An Adaptive Social Engineering Technique, Center for Internet Security (2025). Used for: typical delivery via compromised legitimate websites. Listed in S3 research notes.
16. How ClickFix attacks work and how to stop them, CrowdStrike (2026). Used for: attack-flow corroboration (compromised site → paste-and-run). Listed in S3 research notes.

← All video resources · Subscribe on YouTube