The most uncomfortable thing about ClickFix has always been how cheap it is. No exploit chain, no signed driver, no zero-day burned. Just a web page that tells the user something is broken, offers a helpful fix, and asks them to press Windows+R and paste. The payload arrives by consent. And now, according to reporting this week, the teams that Western governments name in indictments are using it too.

The specifics are worth having. CERT-UA analysed ClickFix on more than ten compromised Ukrainian web resources during June and July, and in at least one case it ended in a network compromise — FreakyPoll, one of Sandworm's own Python backdoors, turned up on a connected device. The fake CAPTCHA served a PowerShell one-liner; what followed was reconnaissance first, with follow-on malware only for machines judged worth keeping.

The technique is boring, which is exactly the problem

If you've triaged phishing for any length of time you'll have seen the pattern. A fake CAPTCHA — "verify you are human" — or a fake browser update, or a Word document that claims to need a rendering fix. The instructions are explicit and the user follows them, because the instructions look like the sort of thing IT would tell them to do. The clipboard is pre-loaded with a PowerShell one-liner obfuscated just enough that a non-technical person sees noise and clicks anyway.

There is nothing clever here in the engineering sense. That's the point. ClickFix bypasses the entire chain of controls we built for the last fifteen years — attachment sandboxing, macro blocking, Mark-of-the-Web, download reputation, EDR's exploit-behaviour heuristics — not by defeating them but by walking around them. The user is the execution vector. Everything downstream of that decision looks like legitimate administrative activity, at least for the first few seconds.

Why state actors adopting it actually matters

I want to be careful here, because there's a lazy version of this story: "advanced adversaries use simple tricks, therefore sophistication is a myth." That's not quite right either. What's changed is the calculus.

State-aligned teams have historically preferred techniques with better operational security — spearphished credentials, edge device exploitation, supply chain access. Those routes are quieter and they scale to specific targets. ClickFix is noisy by comparison. Choosing it means one of two things: either the operators judge that the noise doesn't matter because attribution is no longer a meaningful deterrent, or the technique's success rate is high enough to be worth the exposure. Both readings should worry you. The second is the one I believe, because I've watched the click-through numbers on internal simulations and they are not flattering.

There's also a practical consequence for how you read your own telemetry. If ClickFix is now shared across financially motivated crews and state teams, the initial access pattern stops being a useful attribution signal. A fake CAPTCHA leading to a PowerShell run in your logs used to suggest infostealer or ransomware precursor — an unpleasant but broadly understood category. Now it might be that, or it might be someone establishing quiet persistence for six months of collection. The response posture for those two is not the same, and you can't tell them apart from the delivery mechanism.

What actually works against this

The honest answer is that nothing single-handedly stops it, but the controls that help are unglamorous and mostly already available to you:

  • Block or heavily constrain the Run dialog via Group Policy or Intune for standard users. I've done this in two environments and the helpdesk complaint volume was lower than expected — roughly a dozen tickets in the first fortnight, all from IT-adjacent staff who could be exempted.
  • Alert on explorer.exe spawning powershell.exe, cmd.exe, mshta.exe or conhost.exe. This is the highest-signal detection for the technique and it is cheap to write. Yes, there are false positives from admins; tune by group rather than suppressing globally.
  • Constrained Language Mode and PowerShell script block logging, actually enabled and actually shipped somewhere you look at. Most environments I audit have one of the two.
  • Clipboard-to-terminal awareness in user training. Not a generic phishing module. A specific, ninety-second message: no legitimate website will ever ask you to paste something into a Windows dialog box. That single sentence does more than an hour of annual compliance video.

Notice that three of those four are configuration changes you can make this quarter without procurement. That's deliberate. The temptation when a headline says "elite Russian hackers" is to reach for a new platform. This particular problem does not require one.

The user-blame trap

There's a version of this conversation that ends with "users clicked, users are the weak link." I've sat in enough post-incident reviews to know that's both true and useless. The user was presented with a competent, plausible instruction that mimicked the tone and format of legitimate IT communication. If your organisation sends emails asking staff to run scripts, install agents, or paste registration codes — and most do — then you have trained your people to comply with exactly this shape of request.

The fix on that side is behavioural consistency from IT, not more scolding. Decide the channels through which you will ever ask a user to execute something, publish them, and never deviate. If the only place a legitimate fix ever comes from is Company Portal, then a web page asking for Windows+R is obviously wrong. That's a discipline problem in your own department before it's an awareness problem in theirs.

What I'd change in the detection stack this month

Two things, in order. First, write the parent-child process rule if you haven't. It takes twenty minutes in Defender XDR's advanced hunting and you can retro-hunt ninety days of telemetry with the same query — I'd do that before writing the alert, because knowing whether this has already happened to you changes the urgency considerably.

Second, review what your standard user build permits. Not the full application-control fantasy, just the small set of interactive execution paths: Run dialog, Windows Terminal, Registry Editor, mshta. Most business users need none of them and their removal costs nearly nothing. Every environment I've hardened this way found at least one team quietly depending on something they shouldn't have been — which is itself worth discovering on a Tuesday rather than during an incident.

The broader lesson is one I keep relearning: adversary capability tiers are less about technique than about patience and objectives. The same three-line PowerShell command can be the start of a fifty-dollar credential theft or the start of a two-year intelligence operation. Your controls have to assume the second while your alert volumes look like the first.

Source: Now, even Russia's most elite hackers are using Clickfix to infect devices