The ClickFix attack uses a convincing fake Windows Update screen to trick people into running malicious commands. Threat actors rely on full-screen browser pages that mimic legitimate system updates and then use JavaScript to load harmful instructions into the clipboard. The attack has evolved with stealthier payload delivery, including embedding malware inside image files through steganography. Security researchers report that recent variants now deploy LummaC2 and Rhadamanthys information stealers.
Relevant Source (Huntress): ClickFix Gets Creative: Malware Buried in Images
Technical analysis of a ClickFix campaign that uses full-screen browser lures, mshta, and steganography in PNG images to deliver LummaC2 and Rhadamanthys infostealers.
Quick Facts
- Fake Windows Update screens push victims to run dangerous commands.
- Attackers load malicious commands into the clipboard through JavaScript.
- Malware payloads hide inside PNG images using steganography.
- Recent attacks drop LummaC2 and Rhadamanthys infostealers.
- The campaign abuses mshta, PowerShell, and .NET loaders.
- Monitoring process chains helps detect these attacks early.
How ClickFix Works
ClickFix is a social engineering technique that convinces users to paste attacker-controlled commands into Windows. The victim sees a realistic update or verification screen that runs full screen and blocks normal navigation. JavaScript on the page silently copies malicious commands to the clipboard while the on-screen prompt instructs users to press a sequence of keys that pastes and executes those commands. The attackers then launch a multi-stage payload where mshta triggers JavaScript that leads into PowerShell and a custom .NET loader that extracts shellcode from an encrypted PNG.
- Commands are silently preloaded into the clipboard.
- mshta executes the initial malicious JavaScript.
- A .NET Stego Loader rebuilds hidden shellcode from PNG pixel data.
ClickFix relies on trust in Windows visuals and basic keyboard shortcuts. The attack works because the process feels like routine system maintenance, which lowers suspicion.
Relevant Source (Huntress): ClickFix Gets Creative: Malware Buried in Images
Huntress breaks down a real ClickFix campaign that uses fake Windows Update pages, clipboard-loaded commands, mshta, PowerShell, and a .NET stego loader that pulls shellcode from PNG images.
Relevant Source (Forescout): Infostealer Watch: Will Lumma’s Takedown Help Rhadamanthys Rise?
Forescout details recent ClickFix attacks that trick users into executing commands and deliver LummaC2 and Rhadamanthys via multi-stage chains, mirroring the social engineering and payload flow described here.
Why It Matters
ClickFix remains popular because the victim does most of the execution work. Attackers do not need vulnerabilities or exploits when users willingly run the commands themselves. The shift to steganography inside PNG files creates a tougher detection challenge for defenders because the payload blends into normal image data. Huntress reports show that current variants also use a tactic called ctrampoline where malware calls thousands of empty functions to stall analysis tools.
- No exploit needed because user actions launch the attack.
- Steganographic payloads bypass many signature-based scanners.
- mshta, PowerShell, and .NET loaders enable flexible delivery.
- LummaC2 and Rhadamanthys steal browser and system credentials.
- Fake update screens increase credibility and trick nontechnical users.
These developments show that ClickFix is becoming more complex and harder to detect, which increases risk across personal and business environments.
Relevant Source (Proofpoint): Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
Proofpoint details how ClickFix relies on victims manually executing attacker commands, highlighting why the technique is effective without exploits and increasingly hard to detect at scale.
Relevant Source (Palo Alto Networks Unit 42): Fix the Click: Preventing the ClickFix Attack Vector
Unit 42 analyzes multiple ClickFix campaigns delivering Lumma Stealer and other malware, explaining the growing sophistication of the attack chain and the risks it poses to organizations.
What To Do Now
Anyone responsible for system security should treat any browser-based update screen as suspicious. Real Windows updates never install through a website or instruct users to paste commands. Security teams should block mshta when possible and watch for command chains where explorer.exe launches mshta.exe or PowerShell. Basic policy changes such as disabling Windows Run box execution for standard users can remove the final step attackers rely on.
Recommended steps:
- Block mshta.exe unless required.
- Monitor PowerShell and unusual parent-child process chains.
- Train users to avoid copying update commands from websites.
- Check RunMRU registry entries during incident response.
- Enable security tools that inspect clipboard manipulation.
ClickFix attacks often succeed because the prompts look legitimate. A few technical controls and a small amount of user training can sharply reduce exposure.
Relevant Source (CISA): Identifying and Mitigating Living Off the Land Techniques
CISA describes how attackers abuse native tools like mshta.exe and PowerShell and recommends monitoring high-risk LOLBins and tightening execution policies, which supports the suggested controls in this section.
Relevant Source (Red Canary): Mshta | Threat Detection Report
Red Canary explains how to detect suspicious mshta.exe activity, including watching explorer.exe as the parent process and tracking abnormal process chains, directly aligning with the advice to block mshta and monitor parent-child relationships.
The Big Picture
ClickFix is part of a broader trend where cybercriminals imitate trusted operating system interfaces to bypass user skepticism. Fake update pages, human verification screens, and service interruption notices all pull from the same social engineering playbook. These approaches work because attackers know that many users follow on-screen instructions without questioning whether the source is legitimate.
Steganography and multi-stage loaders show how far criminal groups are willing to go to hide payloads inside common file types. Security firms continue to detect new layers of obfuscation designed to waste analyst time and slip past automated scanning systems. This type of innovation signals that ClickFix will likely remain active in evolving forms.
Relevant Source (Microsoft Security): Think Before You ClickFix: Analyzing the ClickFix Social Engineering Technique
Microsoft describes how modern social engineering campaigns mimic trusted system interfaces and rely on user actions to execute commands, supporting the point that visual lures and instructions are central to ClickFix-style attacks.
Relevant Source (CIS / MS-ISAC): CTAs Leveraging Fake Browser Updates in Malware Campaigns
The Center for Internet Security details campaigns that use fake browser and update prompts on compromised sites, illustrating the broader trend of abusing operating system–like visuals and on-screen instructions to bypass user skepticism.
Final Thoughts
ClickFix attacks succeed by turning routine computer habits into security risks. Treating any unexpected update prompt in the browser as unsafe helps prevent accidental execution of embedded commands. Small policy restrictions and steady monitoring create strong barriers against a technique that relies on users doing what seems normal.
Common Questions
Is a real Windows Update ever delivered through a website?
No. Windows updates only run through the Settings app or enterprise management tools.
Why do attackers use images to hide malware?
PNG steganography hides payloads inside pixel data, making detection harder.
What happens if I already pasted a command from a fake update page?
Disconnect from the internet and run a full malware scan using reputable tools.
Does blocking mshta prevent the attack?
It disrupts the first stage, which stops many ClickFix variants.
How can analysts confirm a user ran malicious commands?
Check the RunMRU registry key for recent command history.
How JENI Helps Strengthen System Safety
JENI focuses on practical system hardening that reduces the weak points attacks like ClickFix depend on. The software streamlines maintenance, monitors performance, and keeps key areas of Windows optimized so suspicious behavior is easier to spot. Clear diagnostics and steady system health checks support a safer environment where deceptive prompts stand out.
Key Ways JENI Supports Security
- Flags unusual resource spikes that often appear during hidden payload execution.
- Improves system responsiveness so fake “update lag” is easier to recognize as suspicious.
- Helps users understand baseline system behavior, which makes anomalies more visible.
JENI strengthens the foundation that attackers try to take advantage of when they rely on confusion or system slowdowns. A well-maintained machine interrupts the social engineering flow of campaigns like ClickFix. Cleaner logs and predictable performance help analysts trace unusual activity faster. Stable systems reduce the likelihood that fake update pages or verification screens will be believed in the first place.
