Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them

Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. 

The meeting never starts. The command does something else entirely.

This is ClickFix, a social engineering technique that turns the victim into the mechanism for executing an attack. CrowdStrike Intelligence has observed adversaries including STARDUST CHOLLIMA and VOODOO BEAR using ClickFix in real-world operations. Further, the CrowdStrike 2026 Global Threat Report documented a 563% increase in incidents involving fake CAPTCHA lures in 2025. 

ClickFix is effective because it exploits something security teams cannot simply patch: a user's instinct to solve a problem. In this blog post, we explain what ClickFix is, how it works, and how CrowdStrike stops these attacks.

Instead of convincing someone to open a suspicious attachment, ClickFix gives them a seemingly legitimate reason to execute a command themselves. The “error” it presents might claim a meeting application needs to be repaired, a browser needs to be verified, or a CAPTCHA needs to be completed. 

Whatever the pretext, the objective is the same: Move malicious instructions from an adversary-controlled webpage into a trusted operating system tool. 

A typical ClickFix chain looks like this:

The adversary creates the problem: The victim lands on a compromised site displaying a fake error, CAPTCHA, or system message. Depending on the sophistication of the attack, the adversary may use a phishing email or more targeted techniques to get them there.

The website provides the "solution": The page instructs the user to copy a command. In some variants, malicious JavaScript may place the command directly onto the clipboard.