#ClickFix

ClickFix is a social-engineering technique where a malicious page shows a fake error message or CAPTCHA and tells the victim to open the Windows Run dialog or a terminal, paste a command, and press Enter to "fix" or "verify" something. The command was copied to the clipboard by the page's own JavaScript; the victim never sees it before running it. MITRE ATT&CK tracks it as T1204.004 (Malicious Copy and Paste), added to the framework in 2025.

Because the victim, not the browser, executes the code, the trick sidesteps the download-and-double-click chain that most browser and endpoint defenses are tuned to catch. It also leans on user habits: people are used to clicking through CAPTCHAs and error dialogs quickly, so the extra step of opening Run and pasting a command reads as routine friction rather than a warning sign.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. ClickFix-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this ClickFix subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.