ClickFix malware delivery
Attackers use fake browser and operating-system prompts to persuade users to run commands or install malware themselves.
- Momentum score
- 63
- Impact
- Moderate
- Confidence
- High
What it is
ClickFix is a social-engineering technique that presents a fake error, CAPTCHA, update, or repair instruction and tells the victim to paste or run a command that installs malware. It does not depend on exploiting a software vulnerability; it turns the user into the execution step. The technique emerged as a way to work around browser and email protections and has since been reused inside many delivery campaigns, including CaptiveCrunch.
Why it is rising
Microsoft observed ClickFix variants inside CaptiveCrunch and broader email campaigns, including delivery paths aimed at Windows and Android users.
Six-month trajectory
Normalized weekly momentum for prototype validation
+9 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Teach buyers to recognize attacks that turn users into the execution mechanism.
- 02Connect endpoint behavior controls with role-specific awareness training.
- 03Build a short campaign around fake update prompts and verification habits.