No. ClickFix is a social engineering technique: The "attack" is the deception that convinces a user to paste and execute a command as if it were a legitimate troubleshooting step. The malware, if delivered, comes later. ClickFix commonly begins on a malicious or compromised webpage that uses paste jacking to preload the clipboard and then instructs the victim to run the content via the Windows Run dialog (Win+R). That user-initiated execution is what turns a web prompt into an endpoint compromise attempt.

How is a FileFix attack different from a ClickFix attack?

The core trick, copy-paste deception, is the same, but the execution point changes. ClickFix pushes the user into the Win+R Run dialog. FileFix shifts execution to File Explorer: A webpage triggers a file-selection dialog so an Explorer window appears, then the FileFix lure instructs the user to press Ctrl+L (address bar) and paste a "file path" that is a command. FileFix can proxy execution through explorer.exe and may complicate simplistic detections that only look for browsers spawning shells.

What is paste-jacking in ClickFix campaigns?

Paste-jacking is the clipboard manipulation step that makes ClickFix and FileFix scale. A malicious webpage uses script logic to copy a full command string into the user’s clipboard, often tied to a user click, so it feels like a normal action. The ClickFix site then displays step-by-step instructions, for example "open Win+R and paste," so the victim performs the execution themselves. Paste jacking exploits the boundary between browser security context and OS shell context: The browser doesn’t run the command, but it sets the user up to do so.

Why does mshta.exe matter for ClickFix and FileFix defense?

mshta.exe is a legitimate, signed Microsoft utility designed to execute HTML application (.hta) files. In documented ClickFix and FileFix chains, the pasted command frequently invokes mshta.exe to retrieve and execute a remote loader stage. Because mshta.exe is a trusted Windows binary, traditional defenses that focus primarily on blocking unsigned or obviously malicious executables may not generate early alerts. The activity can appear legitimate at first glance, even though it enables remote code execution. Defensive guidance includes monitoring for mshta.exe initiating outbound network connections and reviewing unusual parent-child process relationships, such as a browser or explorer.exe spawning mshta.exe. In environments where it is not required for business workflows, disabling mshta.exe for standard users can significantly reduce ClickFix risk.

Can traditional antivirus detect ClickFix and FileFix attacks?

Traditional signature-first antivirus is at a disadvantage because ClickFix and FileFix do not begin with a malicious attachment or dropped executable. The initial ClickFix action is a user-executed command run through trusted Windows interfaces and legitimate system binaries. Effective detection of ClickFix relies on behavioral analysis rather than static signatures. Defenders should correlate suspicious process chains (for example, browser to explorer.exe to PowerShell), monitor for stealth PowerShell flags such as hidden windows, execution-policy bypass and encoded commands and detect in-memory or injection behaviors associated with multistage loaders, including steganographic delivery chains.

What registry artifacts should defenders monitor for ClickFix and FileFix?

Registry artifacts can provide practical early indicators. For FileFix, monitoring the TypedPaths key at HKCU can help identify suspicious address-bar entries tied to FileFix Explorer-based execution. For ClickFix, reviewing Run dialog history artifacts such as RunMRU can surface early signs of pasted ClickFix command execution. Registry monitoring is most effective when combined with behavioral process-tree analysis to confirm whether a pasted string led to shell or loader activity.

Why is user training alone insufficient against ClickFix and FileFix?

ClickFix and FileFix exploit routine IT behavior and familiar visual cues. Attackers imitate trusted brands and verification patterns, presenting the copy-and-paste step as a normal troubleshooting action. Many users prioritize quickly resolving a perceived issue over deeper validation. Security awareness programs must expand beyond "don’t click links" to include "don’t run commands from websites." However, training alone is insufficient because the ClickFix execution path blends into legitimate administrative activity and may evade simplistic controls. Behavioral and endpoint-level protections remain necessary.

What is ClickFix? How ClickFix and FileFix social engineering attacks work and how to defend against them

ClickFix and FileFix: Key takeaways

ClickFix and FileFix are social-engineering techniques that trick users into running attacker commands as a "fix" or verification step.
The core signal is "copy-paste and run": ClickFix uses Win+R (the Run dialog) and FileFix uses Ctrl+L (the Explorer address bar), enabled by pastejacking (clipboard-preloaded commands).
ClickFix and FileFix enable initial access via trusted Windows utilities, notably mshta.exe and PowerShell with stealth flags, proxying execution through user action rather than exploiting a vulnerability.
517% surge in H1 2025, 47% of recorded initial-access attacks, 8% of blocked attacks, 400% phishing-URL growth (May 2024 to May 2025) and an estimated 147,521 infections in one ClearFake cluster, per Expel analysis.
Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) mitigates ClickFix and FileFix with layered controls: URL filtering, behavioral detection (Active Protection), EDR / XDR visibility, Data Loss Prevention and immutable backup and recovery.

What are ClickFix and FileFix? Definition and key concepts

ClickFix and FileFix should be treated as social engineering techniques: a repeatable mechanic for deception and execution. A campaign is the coordinated operation that uses the ClickFix or FileFix technique against targets over time. A lure is the specific psychological "hook," the visual or scenario, that pushes the user into compliance.

The same ClickFix technique can appear across different campaigns and lures. Common ClickFix lures include:

"Robot check" or "human verification" screens, often presented as a technical requirement to proceed.
A fake "Windows Update" splash page that pressures users to "confirm" or "finish" an update.
A "Facebook account suspension" alert used to drive FileFix execution patterns.

How do ClickFix and FileFix differ? The execution surface

ClickFix instructs the user to open the Windows Run dialog (Win+R) and paste a preloaded command, then press Enter.
FileFix shifts the same copy-paste deception into File Explorer: it opens an Explorer window, often as a "file upload" dialogue, then instructs the user to press Ctrl+L (address bar) and paste what looks like a benign path but is actually a command. FileFix can proxy execution through explorer.exe.

How do ClickFix and FileFix abuse living-off-the-land (LotL) binaries?

ClickFix and FileFix commonly lean on trusted system binaries. Examples include invoking mshta.exe to run remote HTML applications (.hta) and using PowerShell with flags that hide the console window, bypass policy, skip profiles and pass encoded strings to reduce straightforward keyword detection.

How does a ClickFix attack work? Step-by-step attack flow

ClickFix is most effective when the attacker can make the user believe the copy-paste step is normal troubleshooting or mandatory verification.

Phishing emails, malvertising and SEO poisoning: The user is routed to a malicious ClickFix landing page through phishing links, compromised sites, malvertising placements or search manipulation leading to look-alike “verification” pages.
Fake CAPTCHA or verification lure: The ClickFix page presents a credible "human verification" or "fix-this-error" prompt that blocks access until the user completes a set of steps.
Clipboard "pastejacking": JavaScript on the ClickFix page silently copies a full command string to the clipboard, not just a URL. This can occur via clipboard-write logic tied to a user gesture, which makes it feel like a normal click interaction.
Win+R execution: The ClickFix lure instructs the user to open the Run dialog (Win+R), paste (Ctrl+V) and press Enter, turning the human into the execution mechanism.
mshta.exe and PowerShell download stage: The pasted ClickFix command often invokes LotL tooling such as mshta.exe, to execute a remote .hta, or PowerShell with stealth and policy-bypass flags for quiet execution and reduced obvious artifacts.
Payload delivery: The objective of the ClickFix attack is typically the delivery of a second-stage payload, frequently an infostealer or a remote-access tool, followed by credential theft and follow-on access expansion.

How did FileFix evolve from ClickFix?

FileFix emerged as an adaptation after defenders began paying closer attention to ClickFix’s Run-dialog execution patterns. Instead of pushing the user into Win+R, FileFix shifts the same "copy-paste and run" moment into a Windows Explorer UI where pasting strings feels routine.

How does FileFix use Ctrl+L and explorer.exe?

In a FileFix flow, the malicious page can trigger a legitimate file-selection dialog. This brings an Explorer window to the foreground. The FileFix lure then guides the user to press Ctrl+L (address bar) and paste the "file path," which is actually a command. Execution can be proxied through explorer.exe, complicating simplistic detection logic that expects the browser to spawn shells directly.

How quickly did FileFix move from concept to exploitation?

FileFix was first introduced as a proof of concept by mr. d0x in June 2025. Within weeks, FileFix moved into active exploitation, including activity associated with the KongTuke cluster. The transition from theory to operational use occurred in roughly 14 days, highlighting how quickly threat actors can weaponize publicly documented techniques.

What is FileFix 2.0 and how does it bypass mark of the web (MoTW)?

A later evolution, often referred to as FileFix 2.0, adds a mark-of-the-web (MoTW) bypass. In this FileFix 2.0 variant, the lure instructs the user to save the malicious webpage using the browser’s "Save As" function (Ctrl+S). Due to a documented handling gap with locally saved "Complete HTML" pages, the resulting files and embedded scripts may lack MoTW tagging. Without that tag, SmartScreen-style warnings are reduced or absent when the user later renames and opens the file as instructed.

ClickFix and FileFix by the numbers: Key statistics (2025)

Metric

Recorded value (2025)

Impacted sector

Attack growth

517% increase in H1 2025

Hospitality (Booking.com lures)

Initial access share

47% of recorded attacks

Financial services (tax and Meta lures)

Total blocked share

8% of all blocked cyberattacks

Technology and retail (Google Meet and Discord lures)

Phishing URL growth

400% (May 2024 to May 2025)

Manufacturing (IP theft)

Infection scale

147,521 systems (one cluster)

Global

What payloads do ClickFix and FileFix deliver? The payload ecosystem

The ClickFix / FileFix command is rarely the "end" of the intrusion. It is typically a loader step designed to fetch and execute a broader malware stack for credential theft, persistence and follow-on access.

Infostealers are a common outcome in ClickFix and FileFix chains, since stolen credentials and session material are highly monetizable. Payloads associated with ClickFix and FileFix techniques include Lumma Stealer, StealC v2 and Rhadamanthys, including variants delivered via mshta-based downloaders.

A later evolution observed in ClickFix campaigns is steganography: Hiding malware components inside image files to blend into normal traffic patterns, including content served through image hosting or CDNs. In one chain identified by Acronis TRU, an initial PowerShell command downloads a .NET assembly that reconstructs shellcode hidden in a JPG’s pixel data, notably the red channel, enabling execution without a simple “malicious executable dropped to disk” event.

Why mshta.exe and PowerShell matter in the ClickFix ecosystem: these techniques exploit trusted tooling.

mshta.exe can execute remote .hta content, helping ClickFix attackers avoid unsigned binaries at the first stage.
PowerShell variants frequently use flags intended to reduce user visibility and weaken policy constraints, including hidden windows, execution policy bypass, no-profile execution and encoded command strings.

How do ClickFix and FileFix lead to ransomware?

ClickFix and FileFix are effective because they front load the intrusion with credential harvesting and stealthy initial access rather than noisy exploitation. Once credentials, tokens or remote access are established through ClickFix or FileFix, intrusions can shift from "one endpoint event" to broader network impact.

Credential theft via infostealers delivered by ClickFix can expose privileged identities, VPN access, SaaS sessions and browser-stored secrets.
Initial access broker resale is enabled when stolen access from ClickFix attacks is packaged and sold, allowing specialized actors to monetize access and other groups to focus on post-exploitation.
Silent infiltration using legitimate utilities, including the Run dialog, Explorer, PowerShell and mshta.exe, can resemble normal administrative activity, slowing response and enabling staged escalation.
Lateral movement and enterprise-scale impact become feasible after access is expanded beyond the first host, especially in sectors called out for high-value data and operations, including manufacturing-focused intellectual property theft activity.

Which threat actors use ClickFix and FileFix?

Threat actor

Primary technique

Known payloads

TA571

ClickFix (first identified March 2024)

Lumma Stealer, DarkGate

Storm-1607 / 0426

ClickFix / Run dialog

Various infostealers

KongTuke

FileFix (active exploitation)

Infostealers

JackFix actors

Screen hijacking / fake updates

Atomic macOS Stealer (AMOS)

Why are MSPs at elevated risk from ClickFix and FileFix?

ClickFix and FileFix are techniques designed to slip through the gaps created by a fragmented security stack and to blend into legitimate administrative behavior by using tools that IT teams themselves commonly use, such as the Run dialog and PowerShell. This combination increases operational burden in any environment where defenses are split across multiple layers and where correlating browser activity to endpoint execution chains is essential.

Enforce web-layer controls to reduce exposure to malvertising and SEO-poisoned landing pages before the ClickFix lure loads.
Prioritize behavioral process-tree correlation (for example, browser to explorer.exe to PowerShell or mshta.exe), because the user is the "execution bridge" between web content and OS shell in ClickFix and FileFix attacks.
Treat copy-paste instructions that include Win+R or Ctrl+L as high-confidence "social engineering execution" indicators and update training accordingly: "Don’t run commands from websites."

How does Acronis protect against ClickFix and FileFix?

Acronis mitigates ClickFix and FileFix across prevention, detection and recovery layers. The table below maps each attack stage to the risk, the capability required to address it and the corresponding Acronis response.

Attack stage

Risk

Required capability

Acronis capability

Outcome

Reconnaissance and initial lure

Users reach a ClickFix or FileFix landing page via phishing links, malvertising or SEO poisoning, where a fake CAPTCHA or verification prompt triggers clipboard-write behavior.

Web-layer blocking of known and newly registered malicious domains.

URL filtering

Prevents the lure page from loading in the browser, blocking the paste-jacking prompt before the clipboard is ever touched.

Execution

User pastes into Win+R or File Explorer; suspicious parent-child process chains form.

Behavioral process-tree monitoring and interruption of suspicious chains.

Active Protection (behavioral engine)

Stops suspicious process chains (for example, browser to explorer.exe to PowerShell) and blocks hidden ClickFix command execution, including zero-day variants.

Payload delivery

Living-off-the-land downloaders and in-memory behaviors, including steganographic multistage loaders.

Advanced endpoint detection focused on behavior and memory artifacts.

Acronis Security + EDR

Detects in-memory shellcode behaviors and other activity traditional file scanning can miss.

Data exfiltration

Infostealer credential theft and data leakage over monitored channels.

Content-aware data loss prevention across local and network channels.

Advanced DLP (add-on)

Detects and blocks attempts to move stolen data out through monitored channels such as web uploads, cloud storage, email and clipboard.

Impact and recovery

Ransomware or data-theft follow-on damage; tool tampering.

Recovery and restoration to a known-good state.

Immutable backup and recovery

Restores endpoints if a multistage intrusion causes disruption or data loss. Immutable backup does not neutralize data that has already been exfiltrated.

Frequently asked questions about ClickFix and FileFix

Is ClickFix malware?
No. ClickFix is a social engineering technique: The "attack" is the deception that convinces a user to paste and execute a command as if it were a legitimate troubleshooting step. The malware, if delivered, comes later. ClickFix commonly begins on a malicious or compromised webpage that uses paste jacking to preload the clipboard and then instructs the victim to run the content via the Windows Run dialog (Win+R). That user-initiated execution is what turns a web prompt into an endpoint compromise attempt.
How is a FileFix attack different from a ClickFix attack?
The core trick, copy-paste deception, is the same, but the execution point changes. ClickFix pushes the user into the Win+R Run dialog. FileFix shifts execution to File Explorer: A webpage triggers a file-selection dialog so an Explorer window appears, then the FileFix lure instructs the user to press Ctrl+L (address bar) and paste a "file path" that is a command. FileFix can proxy execution through explorer.exe and may complicate simplistic detections that only look for browsers spawning shells.
What is paste-jacking in ClickFix campaigns?
Paste-jacking is the clipboard manipulation step that makes ClickFix and FileFix scale. A malicious webpage uses script logic to copy a full command string into the user’s clipboard, often tied to a user click, so it feels like a normal action. The ClickFix site then displays step-by-step instructions, for example "open Win+R and paste," so the victim performs the execution themselves. Paste jacking exploits the boundary between browser security context and OS shell context: The browser doesn’t run the command, but it sets the user up to do so.
Why does mshta.exe matter for ClickFix and FileFix defense?
mshta.exe is a legitimate, signed Microsoft utility designed to execute HTML application (.hta) files. In documented ClickFix and FileFix chains, the pasted command frequently invokes mshta.exe to retrieve and execute a remote loader stage.
Because mshta.exe is a trusted Windows binary, traditional defenses that focus primarily on blocking unsigned or obviously malicious executables may not generate early alerts. The activity can appear legitimate at first glance, even though it enables remote code execution.
Defensive guidance includes monitoring for mshta.exe initiating outbound network connections and reviewing unusual parent-child process relationships, such as a browser or explorer.exe spawning mshta.exe. In environments where it is not required for business workflows, disabling mshta.exe for standard users can significantly reduce ClickFix risk.
Can traditional antivirus detect ClickFix and FileFix attacks?
Traditional signature-first antivirus is at a disadvantage because ClickFix and FileFix do not begin with a malicious attachment or dropped executable. The initial ClickFix action is a user-executed command run through trusted Windows interfaces and legitimate system binaries.
Effective detection of ClickFix relies on behavioral analysis rather than static signatures. Defenders should correlate suspicious process chains (for example, browser to explorer.exe to PowerShell), monitor for stealth PowerShell flags such as hidden windows, execution-policy bypass and encoded commands and detect in-memory or injection behaviors associated with multistage loaders, including steganographic delivery chains.
What registry artifacts should defenders monitor for ClickFix and FileFix?
Registry artifacts can provide practical early indicators. For FileFix, monitoring the TypedPaths key at HKCU can help identify suspicious address-bar entries tied to FileFix Explorer-based execution.
For ClickFix, reviewing Run dialog history artifacts such as RunMRU can surface early signs of pasted ClickFix command execution.
Registry monitoring is most effective when combined with behavioral process-tree analysis to confirm whether a pasted string led to shell or loader activity.
Why is user training alone insufficient against ClickFix and FileFix?
ClickFix and FileFix exploit routine IT behavior and familiar visual cues. Attackers imitate trusted brands and verification patterns, presenting the copy-and-paste step as a normal troubleshooting action. Many users prioritize quickly resolving a perceived issue over deeper validation.
Security awareness programs must expand beyond "don’t click links" to include "don’t run commands from websites." However, training alone is insufficient because the ClickFix execution path blends into legitimate administrative activity and may evade simplistic controls. Behavioral and endpoint-level protections remain necessary.