ClickFixing is a social engineering attack that manipulates users into executing malicious scripts themselves.
It begins when a user lands on a malicious or compromised website that displays a fake CAPTCHA or human verification page. This page instructs the victim to complete three steps — exactly as shown in the images from sandbox analysis:
These steps cause the victim to unknowingly execute a malicious command through the Windows Run dialogue, often invoking legitimate Windows utilities (LOLBins) such as mshta.exe. This enables attackers to deliver and run malware without dropping an obvious executable.
This technique has been rising rapidly and has now evolved through its combination with steganography.
Steganography is the practice of hiding malicious content within an ordinary, non-secret file to evade detection. Attackers commonly use Least Significant Bit (LSB) steganography to embed malicious scripts inside seemingly normal images, such as PNG files.
When a victim opens or downloads the file, the malware hidden inside it is decoded and reconstructed – often without the victim having any idea anything is happening.
Recent threat activity shows ClickFix campaigns increasingly using fake Windows security update screens. These screens mimic legitimate update messages, such as:
“Working on updates. Please do not turn off your computer.
Part 3 of 3: Check security.”
Victims are then instructed to run a command that triggers mshta.exe, for example:
This initiates the first stage of malware delivery.
The executed command fetches an image file from the attacker’s server. Although the file looks like a standard PNG, it contains an embedded malicious script using steganography.
A loader on the victim’s device decodes the hidden bytes from within the image and reconstructs a full malicious executable or payload – completing the entire infection chain.
This method has been observed in multiple malware families, including LummaC2, and recent research shows new variants embedding encrypted .NET assemblies inside PNG files, as reported by Huntress.
A successful ClickFix malware attack can lead to:
Because execution is initiated by the user via a trusted system utility, traditional defences are frequently bypassed.
ClickFix campaigns are expanding rapidly.
According to InfosecurityMagazine, ClickFix social engineering attacks have surged by 517% in the past six months, now becoming the second most common vector behind phishing.
The threat relies on:
Together, these elements create a scalable and highly effective attack vector.
Educate users to recognise fake verification pages and understand that system updates or CAPTCHA checks never require using the Run dialogue or executing commands manually.
Advanced filtering reduces the likelihood of phishing emails redirecting users to ClickFix-style malicious sites.
Actively monitor and block new IOC domains and prevent access to malicious URLs before users reach them.
Ensure EDR is enabled and fully monitoring. Behavioural detection can identify misuse of LOLBins such as mshta.exe and PowerShell.
Continuously monitor legitimate OS processes for unusual behaviours such as:
This level of telemetry is essential for detecting steganography-based loaders.
Stay ahead of emerging threats like ClickFix and Steganography.
If you’d like to understand your organisation’s exposure or need support strengthening your defences, our CREST-accredited SOC team is here to help. Get in touch with our experts today.
Our Sources:
