ClickFix
Lure technique that tricks users into pasting and running malicious commands.
ClickFix lures, first seen by Microsoft between March and June 2024, moved from criminal malware drops into state espionage: Google reported in May 2025 that Star Blizzard used one to install its LOSTKEYS malware.
Last refreshed: 12 October 2026
How does a fake CAPTCHA trick people into hacking themselves?
Timeline for ClickFix
Mentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesBackground
ClickFix is a social-engineering trick in which a web page shows a fake error message or CAPTCHA check, quietly copies a malicious command to the clipboard and tells the visitor to paste and run it, often through the Windows Run dialog. ClickFix needs no software exploit, because the victim runs the attacker's code by hand.
Microsoft first observed the technique between March and June 2024 in campaigns delivering DarkGate malware, and says Lumma Stealer later became its most frequent payload. Google reported in May 2025 that COLDRIVER, its name for Star Blizzard, used a ClickFix chain to plant LOSTKEYS. Star Blizzard switched to other delivery formats in 2026, when Microsoft tied its phishing to event invitations that sent malware only after a target replied.
Microsoft's advice to defenders is user training, disabling the Windows Run dialog where staff do not need it, and logging and restricting PowerShell.