The most successful attack of 2026 asks your staff to run it themselves, and they usually do
ClickFix shows a visitor a fake Cloudflare or reCAPTCHA screen, quietly puts a command on their clipboard, and tells them to press Windows+R and paste. Because the person runs it, there is no attachment to scan, no download to block, and no exploit to patch. Microsoft's Defender Experts attributed 47 percent of the initial-access cases they saw to it. ESET says its detections more than doubled in six months. Sekoia found the lure injected into 3,800 ordinary WordPress sites across 82 countries, and last week researchers found it hosted on unpkg, a domain every developer trusts. Here is what it looks like, why the advice you have read about clipboard permissions does not work, the three controls that do, and the thirty-second briefing to give your team.
Almost every security control a small business buys is designed to stop something arriving. Email filters stop attachments. Endpoint software stops downloads. Patching stops exploits. Firewalls stop connections. The model underneath all of it is that the attacker has to get something onto the machine, so you inspect the things arriving.
ClickFix skips that entirely. Nothing arrives. The attacker shows your employee a screen that says the page needs to verify them, puts a command on their clipboard without telling them, and asks them to press Windows+R, paste, and hit Enter. Your employee is the delivery mechanism. Every control listed above is looking the other way, because from the operating system’s point of view an authorised user typed a command into the Run box, which is a thing users are allowed to do.
It works well enough that it has become the single most common way attackers get their first foothold.
The numbers, and where they come from
| Source | Figure | Period |
|---|---|---|
| Microsoft Digital Defense Report 2025 | 47% of observed initial-access cases seen by Microsoft’s Defender Experts team | 2025 |
| ESET Threat Report H1 2025 | detections up 517%, roughly 8% of all blocked attacks, second only to phishing | Dec 2024 to May 2025 |
| ESET Threat Report H1 2026 | detections “more than doubled between H2 2025 and H1 2026” | Dec 2025 to May 2026 |
Read those together. The 47 percent figure is the one that should stop you, because it is not a share of attempts, it is a share of successful initial access in incidents Microsoft’s own responders worked. And the ESET figures say the technique did not peak and fade after 2025, which is the normal life cycle for a social engineering trick once it gets written up. It roughly doubled again in the six months to May 2026.
ESET also notes the technique has spread past the fake CAPTCHA into AI-themed help pages, browser extensions, and cloud authentication flows. The lure changes. The move, which is “you paste this and run it,” does not.
What it actually looks like
Four things happen in about eight seconds.
One. Your employee lands on a page. It might be a search result, an ad, a link in an email, or, most commonly and most unfairly, an ordinary website they have used for years that has been compromised.
Two. The page shows a verification screen. The current favourite is an imitation of Cloudflare Turnstile, the “Verifying you are human” widget that millions of legitimate sites genuinely use. Sekoia’s researchers documented a version that displays the text “Unusual Web Traffic Detected.” Others copy Google reCAPTCHA, a Windows Update screen, or a browser crash dialog.
Three. The page writes a command to the clipboard. The victim never sees this happen and never copies anything themselves.
Four. The page gives instructions, usually numbered, sometimes with little keyboard icons: press Windows and R together, press Ctrl and V, press Enter. What gets pasted is a PowerShell one-liner that fetches and runs a script from the attacker’s server. Sekoia observed it establishing persistence through Windows Run registry keys and installing NetSupport RAT, a legitimate remote-control product repurposed as a backdoor. Earlier waves of the same campaign delivered the Emmenhtal loader and XFiles Stealer instead.
The command is usually long, padded with spaces so the malicious part scrolls out of view in the Run box, and dressed up with a comment like # Cloudflare Verification ID: 8c41... at the front so that what the victim glimpses looks like a reference number rather than code.
The part that makes it a small business problem
You might reasonably assume this is a “do not click strange links” problem. It is not, and this is the detail that changes how you brief your team.
In January 2026, Sekoia published research on a campaign they named IClickFix. It is a JavaScript framework injected into compromised WordPress sites, identifiable by an HTML tag with the id ic-tracker-js. They counted more than 3,800 compromised WordPress sites across 82 countries, active since at least December 2024 and still running when they published.
The detail that matters: when Sekoia fingerprinted the infected sites, they were not derelict. The majority were running current or near-current WordPress, versions 6.9 and 6.8.3, with up-to-date Elementor, WooCommerce and Gravity Forms. These are normal, maintained small business sites. Sekoia was not able to determine the initial access vector.
So the site serving the fake CAPTCHA to your employee is a legitimate business’s website, on the correct version, with a valid certificate and a domain your staff recognise. “Only visit sites you trust” is not advice that survives contact with that.
And it runs in both directions. A compromised WordPress site is somebody’s business. Ours or yours could be the one serving the lure, which is the practical link between this post and last week’s on wp2shell, the WordPress core RCE, and this week’s on the TranslatePress admin takeover. Site compromise is not usually about your data. It is about your reputation being borrowed to attack the next person.
Last week’s twist: hosting the lure on a domain developers trust
On August 25, 2026, researchers at OX Security published findings on 24 malicious npm packages with random names such as bgzxcuite2 and prezdentkxheiw. The packages contained no code worth running. Each held a single HTML file: a fake Cloudflare verification page.
The point was not to infect anyone who installed them. The point was that npm packages are automatically mirrored by content delivery networks, and those mirrors serve the files as live web pages. Publish a package containing index.html and it becomes reachable at a URL on unpkg.com, a domain that is entirely legitimate, has a valid certificate, and appears in the source of an enormous number of professional websites. The phishing page is now hosted on infrastructure that no reputation system will flag and no corporate proxy is going to block.
The packages attracted only 50 to 300 weekly downloads each, because downloads were never the goal. When Chrome’s Safe Browsing blocklist caught the first redirect target, a typosquat of a Microsoft login domain, the operators switched to reading the redirect destination from a public key-value store at run time, so the page itself no longer contains the bad address. OX also notes the packages can remain available on mirrors after removal from the npm registry.
We have written twice about npm as a supply chain risk to your build. This is a different use of the same registry: not to poison your dependencies, but to borrow the trustworthiness of a domain.
The advice that does not work
Search for ClickFix mitigation and you will quickly find the suggestion to turn off clipboard access in Chrome: Settings, Privacy and security, Site settings, Clipboard, set it to block.
This does not stop ClickFix. That setting governs whether a site can read your clipboard. ClickFix writes to it. Under the Clipboard API, writing requires only transient activation, which means any interaction at all, including the click on the fake CAPTCHA button, and it is not covered by the permission that Chrome’s site setting controls. Firefox and Brave are stricter about writes than Chromium browsers, but on Chrome and Edge that setting will leave you feeling protected and change nothing about this attack.
Two other pieces of common advice are worth grading honestly. Antivirus and EDR do help, but late: they are looking at what the pasted command spawns, not at the paste, so they are competing with an obfuscated loader rather than blocking delivery. And “train people not to fall for it” is real, but it is the control most likely to fail on a Tuesday afternoon when someone is in a hurry.
The three controls that do work
1. Disable the Run dialog. This is the highest-value control and almost nobody in a small business uses the Run box for anything. It removes the exact step the instructions depend on. Via Group Policy it is User Configuration, Administrative Templates, Start Menu and Taskbar, “Remove Run menu from Start Menu.” The equivalent registry change, per user, is:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /fExplorer needs to restart for it to take effect, so sign out and back in. This also blocks running commands from the File Explorer address bar, which is where the FileFix variant sends people instead. It does not block PowerShell or Terminal for anyone who deliberately opens them, so your developers keep working; it blocks the specific pattern the lure instructs.
2. Turn on the relevant Defender ASR rules. Attack surface reduction rules are part of Microsoft Defender Antivirus and are available on any Windows edition that includes it, Windows 11 Home included. You do not need Defender for Endpoint to use them, only to manage them centrally. Configure them locally with PowerShell or Group Policy. The three that bear on this chain:
| Rule | GUID |
|---|---|
| Block execution of potentially obfuscated scripts | 5beb7efe-fd9a-4556-801d-275e5ffc04cc |
| Block JavaScript or VBScript from launching downloaded executable content | d3e037e1-3eb8-44c8-a917-57927947596d |
| Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c |
The first is the one that matters most here, and it depends on cloud-delivered protection and AMSI being enabled, so confirm those are on rather than assuming. Microsoft’s guidance, which we would repeat, is to run new rules in audit mode first and read what they would have blocked before you switch them to block. On a small business fleet that is a week, not a quarter.
3. Give people a rule they can apply without judgement. Awareness training that asks staff to evaluate whether a page looks legitimate is asking them to win an argument with a designer. Replace it with something absolute:
No website will ever ask you to press Windows+R, or to copy and paste anything into a terminal, a command prompt, or the Run box. Not to prove you are human, not to fix an error, not to finish an update, not to install anything. If a page asks, it is an attack, one hundred percent of the time, including when the site is one we use every day. Close the tab and tell us. You will never be in trouble for reporting one, and you will never be in trouble for reporting one that turned out to be nothing.
That last sentence is doing real work. The reason these incidents get discovered late is not that nobody noticed, it is that the person who pasted the command realised something was wrong and did not want to say so.
If you think someone already ran one
Treat it as a compromised endpoint, not a virus scare. The payloads in circulation are remote-access tools and information stealers, which means the machine’s stored credentials and browser sessions are the actual loss, and they left the building the moment it ran.
- Disconnect the machine from the network. Do not power it off if you might want an investigation.
- From a different, trusted device, revoke all active sessions and then reset that user’s passwords, starting with email and Microsoft 365 or Google Workspace. That order is deliberate. A stolen session cookie survives a password change, so revoking sessions is the step that actually ends the access, and it is the step people skip. We go through the full sequence, and what to check afterwards, in the piece on adversary-in-the-middle session theft.
- Check for a new or unfamiliar entry in the account’s multi-factor methods. Adding one is standard practice for keeping access after a password reset.
- Look at the Run registry keys and scheduled tasks on the endpoint for persistence, then rebuild the machine rather than cleaning it. An infostealer that has already run has already succeeded; what you are removing is the remote access, and you cannot prove you removed all of it.
- Assume anything saved in that browser profile is now known to someone else, and rotate it. This includes the passwords your team saved in Chrome and never told you about.
The bottom line
ClickFix is the clearest illustration we have of where the security perimeter has moved. It contains no exploit, no malware at the point of delivery, and no vulnerability to patch. It targets the one component that is present in every organisation regardless of budget: a person who wants the page to work and is willing to follow four numbered steps to make that happen.
The controls that stop it are dull, cheap and mostly free. Disable a dialog nobody uses. Switch on rules already sitting in the antivirus you have. Give people one flat rule and make it safe to report a mistake. Between them, that is perhaps an hour of work and it removes what Microsoft’s own responders call the leading way attackers get in.
If you want a hand applying the first two across your machines, or you would like us to look at a WordPress site and check whether it is currently serving one of these lures to your customers, get in touch.
Sources
- Microsoft Digital Defense Report 2025, Microsoft
- ESET Threat Report H1 2026, ESET, published July 8, 2026
- ESET Threat Report: ClickFix fake error surges, ESET, June 26, 2025
- Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic, Sekoia TDR, January 29, 2026
- 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages, The Hacker News, August 25, 2026
- ClickFix Phishing Pages Discovered in 24 npm Packages, OX Security
- Attack surface reduction rules reference, Microsoft Learn, for rule names, GUIDs and dependencies
- Unblocking clipboard access, web.dev, on the difference between clipboard read and write permissions