ClickFix Attack Analysis and CrashFix Defense Guide 2026

ClickFix is not an exploit. It is a script that convinces the user to run it. Since 2024 it has become one of the most effective delivery methods for infostealers and remote-access trojans, precisely because it needs no vulnerability at all — the victim supplies the permissions, the keyboard and the click.

The chain, step by step

A typical ClickFix flow looks like this:

1. A believable failure screen. The page renders a fake Cloudflare "verify you are human" check, a broken PDF preview, or a browser error. The visual language is copied from the real thing, down to the logo and the progress spinner.
2. An instruction instead of a button. Rather than asking you to click, the page claims the automatic check failed and offers a "manual fix": copy the text below, press Win+R, paste it, and press Enter.
3. A command disguised as diagnostics. The pasted string usually starts with something recognisable — powershell, mshta, cmd — wrapped in padding so that it reads like a verification token.
4. Execution with your own privileges. Windows runs it as you. There is no UAC prompt because nothing asks for elevation, and user-level rights are enough for a credential stealer.

Why it defeats most endpoint protection

Security software is built to catch processes that appear on their own. ClickFix does the opposite: the process is launched by the logged-in user, from the Run dialog, with a command the user deliberately copied. Behaviourally it looks like an administrator running a diagnostic tool. The reliable detection points are the command content and the parent process chain, not the binary itself.

Two artifacts make investigation possible:

• RunMRU — every command typed into the Run dialog is stored under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU. This is the single most useful place to check after a suspected infection.
• A shell whose parent is explorer.exe — a command shell or PowerShell instance spawned directly from the desktop shell, rather than from a terminal or an installer, is abnormal.

Check your own machine

Open PowerShell and read the Run history:

Get-ItemProperty 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU'

If an entry begins with powershell, mshta, curl, certutil or bitsadmin and you do not remember typing it, treat the machine as compromised. Do not "clean" it by deleting the registry value — the value is evidence, and the payload has already executed.

CrashFix, and why the names multiply

CrashFix is a later variant of the same idea: the lure is a browser or application crash message, and the "fix" is again a command to paste. The branding changes; the mechanism does not. Reports of "ClickFix", "CrashFix" and "FakeFix" all describe one primitive — socially engineering a user into pasting a command.

Variants have also moved off Windows: macOS lures ask the user to paste into Terminal, and Linux lures target shell one-liners. The common factor is a clipboard and a shell, not a particular operating system.

Defences that actually work

Because the attack depends on user execution rather than a memory bug, defences have to target execution policy and detection rather than patching:

• Block interpreters you do not need. Most organisations can disable mshta.exe outright — it is rarely required and is a favourite ClickFix stage. Application control (WDAC or AppLocker) can restrict PowerShell to signed scripts.
• Constrain PowerShell. Script block logging plus constrained language mode turns "run anything" into something auditable and bounded.
• Alert on RunMRU writes. A registry write to the Run history from a browser process is a high-signal, low-cost event.
• Alert on shell children of explorer.exe. Legitimate installers almost never spawn cmd.exe or powershell.exe straight from the desktop shell.
• Teach the concrete pattern, not "be careful". Users respond to a rule they can apply: no genuine verification page ever asks you to press Win+R and paste a command. That one sentence prevents most of these attacks.

If you already ran it

1. Disconnect the network. Infostealers exfiltrate within minutes.
2. Do not reboot or "clean" first — capture the RunMRU value, the process tree, and any files written to %TEMP%.
3. From a different, clean device, rotate every credential stored in the browser: passwords, session cookies, and any vault token that syncs to that machine.
4. Reimage rather than clean. Stealers routinely leave a persistence loader, and manual removal rarely catches all of it.

FAQ

Can antivirus block ClickFix?

Sometimes, by signature on the downloaded payload. It rarely blocks the command itself, because a user running a command is a legitimate action.

Does clicking "copy" alone infect me?

No. Copying only fills the clipboard. Infection requires pasting into a shell and executing it.

Is the Run dialog a real vulnerability?

No. It does exactly what it was designed to do. The abuse is social, not technical.

Why do these pages imitate Cloudflare?

Because that verification screen is familiar, frequent and expected before content. Imitating it borrows trust instead of building it.