One more step before the file opens
It's 4:50 on a Friday. You've got a dozen tabs open, a coffee gone cold, and a Teams notification saying your manager just shared a file. You click it. Why wouldn't you? You've clicked things like this forty times this week.
That's the entire trick. Not urgency, not bad spelling — a real task, with one extra step slipped in that quietly isn't part of the task at all. You meant to open a document. You end up approving an app you've never heard of. That's it. That's the whole move.
It shows up elsewhere too — proving you're human by pasting a command into a terminal, or reading a message by signing into a page that only looks like the one you use every day. Same move, different costume.
Two research teams have mapped this recently, and both are worth reading. Our GETWELL research follows one version from a browser popup to real malware on a real machine. Microsoft traced a separate one from a fake meeting invite straight through to a stolen login. Different disguises. Same underlying move: hold onto what you meant to do, because the page in front of you may have already moved on without telling you.
Three versions of the same idea
Here's what that looks like in practice:
| Technique | The requested action | The consequence |
|---|---|---|
| ClickFix / TermFix | Copy instructions into a local execution tool. | The computer runs a command supplied by the lure. |
| Device code phishing | Enter a supplied code at the genuine identity service. | The initiating client receives authorized tokens. |
| AiTM phishing | Complete a sign-in relayed through a proxy. | The intermediary captures authenticated session state. |
In each row, the moment that actually matters isn't dramatic. It's a terminal window. It's Microsoft's real, unfaked login page. It's a sign-in quietly rerouted through somebody else's server on its way to the real one. None of it looks like a movie hacking scene — that's rather the point.
If you ever have to report one of these, forget the technical name. Nobody expects you to know it. Just say what happened: “I pasted a command.” “I typed a code the email gave me.” “I approved an MFA prompt after clicking a link.” That sentence alone tells a security team almost everything they need.
A clean design is not a character reference
Good spelling. A real logo. A padlock in the address bar. Every legitimate company has these — and by now, so does almost every well-built fake. The padlock tells you the connection to this exact page is encrypted. It has nothing to say about whether the page has any right to ask what it's asking.
A link can drop you somewhere real, then quietly carry you somewhere else a second later. A CAPTCHA can exist purely to keep bots out before the actual scam loads behind it. Your own email, already sitting in the login box, waiting for you — that's not proof of anything. It's a form field somebody pre-filled, because pre-filling it is easy and it works.
A “copy this” button removes the one bit of friction that might have made you pause. A QR code moves the interaction onto your phone, off the computer that has your company's actual defenses running on it. None of this is new. What's new is how well it's made.
Researchers tracking Tycoon2FA describe it less like a one-off scam and more like a product — built once, packaged, resold. You're usually not up against someone improvising at 2 a.m. You're up against a kit. Worth remembering next time something feels unusually polished — polish, it turns out, is for sale now.
Trace the path backward
Start with how you arrived, not with what's on the screen. A bookmark you open every morning puts you in a different position than a link a stranger dropped into your inbox an hour ago. If the request touches your money, your access, or your security settings, check with the sender through a channel you already trust — not the one the message just handed you.
Then ask what set this off. A device code on screen — which app did you actually open to generate it? A command you're meant to paste — why would this task need one at all? An MFA prompt waiting for your thumb — what, specifically, are you approving, and did you ask for it?
The address bar still matters. Typos and strange domains remain one of the most reliable tells there is. But don't let a clean, professional page talk you out of checking — design has gotten cheap, and it's getting cheaper.
Last question, and it's the simplest one: does this match what you were actually trying to do? A shared file lives in your real document tool. A meeting lives in your real calendar. Taking that separate path costs thirty seconds. It tends to tell you everything the link was hoping you wouldn't ask.
Why these scams can feel weirdly personal
Your browser tells every website a fair amount about you before you've done anything at all — your operating system, your browser version, sometimes more. Legitimate sites use that to hand you the right instructions automatically. Fake ones use the same signals to hand you a scam built specifically for Windows, or specifically for Mac. It isn't reading your mind. It's reading your user agent string.
Our live diagnostic shows exactly what your browser is giving away right now. The Learn section explains what that data means — and just as usefully, what it doesn't. Once you've seen it laid out, “tailored to you” stops feeling like a compliment.
There's a quieter layer underneath. Once you sign in anywhere, cookies and tokens keep that session alive — and they keep working long after you've closed the tab. A sign-in that felt small in the moment can have consequences that outlast the moment by weeks. The question worth asking afterward isn't just whether you got phished. It's what access that moment created, and who else can use it now.
Make it easy to speak up
These messages catch people mid-shift, on small screens, running late for the next thing. Not careless people. Busy ones — which is everyone, eventually. So don't make anyone prove it was malicious before they're allowed to say something. Make it easy to flag first. Sort out the rest after.
Save the original message and roughly when it landed. Say plainly what you clicked, typed, copied, or approved — no need to soften it. If you ran a command, tell your security team now, not after lunch. If you approved a sign-in, your identity team needs to check what that access allows, quickly.
Every guide below covers its own next steps. The habit underneath all of them is the same one: notice the action before you finish it. And if something already feels off — say so. Nobody gets phished because they were foolish. They get phished because it was built, carefully, to feel exactly like the thing they were already doing.
Keep reading
Follow the ClickFix guide, device-code journey or AiTM relay. For original technical analysis, visit the Research library.