IOCs by window
3
IOCs tagged #ClickFix
29
IOCs tagged #ClickFix
439
IOCs tagged #ClickFix
1,044
IOCs tagged #ClickFix
Counts as of 2026-10-22. Regenerated daily.
About #ClickFix
- What: Social engineering. A fake error or CAPTCHA page.
- Ask: Open Run or a terminal, paste a command.
- Flow: Page JavaScript copies the command. Victim presses Win+R, pastes, hits Enter.
- Why it works: Victim runs it. No exploit, skips file-download steps AV / EDR usually watch.
- Payloads: Mainly a delivery step for RATs and infostealers, not a payload itself.
- References: MITRE ATT&CK T1204.004.
Recent IOCs tagged #ClickFix
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/clickfix.
| Date | Type | Value | Source |
|---|---|---|---|
| domain | |||
| url | |||
| ip | |||
| domain | |||
| url | |||
| domain | |||
| url | |||
| url | |||
| ip | |||
| url |
Related tags
Frequently asked questions
What is ClickFix?
A fake error or CAPTCHA page tells the victim to paste a command, already copied by its JavaScript, into Run or a terminal. MITRE tracks it as T1204.004.
Why does ClickFix work if the victim has to run the command themselves?
The victim runs the code, so it skips the download-and-double-click chain that most browser and endpoint defenses watch. People click through CAPTCHAs fast, so the step looks normal.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this ClickFix subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
ClickFix IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.