#ClickFix
Social-engineering technique that tricks a victim into pasting an attacker command into the Run dialog or a terminal
IOCs by window
6
IOCs tagged #ClickFix
13
IOCs tagged #ClickFix
111
IOCs tagged #ClickFix
547
IOCs tagged #ClickFix
Counts as of 2026-08-22. Regenerated daily.
About #ClickFix
- Definition: a social-engineering technique where a page shows a fake error message or CAPTCHA and instructs the victim to open the Windows Run dialog or a terminal and paste a command. The victim executes the malicious command themselves, so the flow needs no exploit and skips the file-download steps that AV / EDR usually watch.
- Typical flow: the page copies a command to the clipboard via JavaScript, then tells the victim to press Win+R (or open a terminal), paste, and hit Enter to "verify" or "fix" a problem that does not really exist. The pasted command downloads and runs the actual payload.
- Payloads observed: used mainly as a delivery step ahead of RATs and infostealers rather than as a payload of its own; researchers tag the technique alongside whatever family the page ultimately drops.
- References: MITRE ATT&CK T1204.004.
Recent IOCs tagged #ClickFix
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/clickfix.
| Date | Type | Value | Source |
|---|---|---|---|
| domain | |||
| url | |||
| url | |||
| domain | |||
| url | |||
| sha256 | |||
| domain | |||
| url | |||
| sha256 | |||
| domain |
Related tags
Frequently asked questions
What is ClickFix?
ClickFix is a social-engineering technique where a malicious page shows a fake error message or CAPTCHA and tells the victim to open the Windows Run dialog or a terminal, paste a command, and press Enter to "fix" or "verify" something. The command was copied to the clipboard by the page's own JavaScript; the victim never sees it before running it. MITRE ATT&CK tracks it as T1204.004 (Malicious Copy and Paste), added to the framework in 2025.
Why does ClickFix work if the victim has to run the command themselves?
Because the victim, not the browser, executes the code, the trick sidesteps the download-and-double-click chain that most browser and endpoint defenses are tuned to catch. It also leans on user habits: people are used to clicking through CAPTCHAs and error dialogs quickly, so the extra step of opening Run and pasting a command reads as routine friction rather than a warning sign.
How is this list updated?
Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. ClickFix-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.
What is the license? Can I use this commercially?
All TweetFeed IOC data, including this ClickFix subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.
License
ClickFix IOC data: CC0 1.0 Public Domain. No attribution required, no warranty. Source code for the pipeline: github.com/0xDanielLopez/TweetFeed (MIT).