A new report by **CTM360** sheds light on **ClickFix**, an increasingly prevalent initial-access technique that has become a significant concern for enterprise security. Unlike conventional attacks, **ClickFix** doesn't rely on exploits, malicious attachments, or files on disk. Instead, it subtly manipulates users into executing commands, making it incredibly difficult for traditional defenses to detect. **ClickFix** has rapidly escalated from a novel technique in late 2023 to a sophisticated subscription product, complete with on-chain infrastructure and a state-sponsored user base. Its rise signifies a critical shift in the threat landscape, rendering traditional defenses like malicious domain blocking largely ineffective. ### The Mechanics of Deception The attack typically begins with a deceptive web page presenting a problem the user believes they need to solve – a failed human verification, a rendering issue, or a document that won't open. The page then offers a 'remedy' in the form of instructions, quietly writing a malicious command to the user's clipboard. The user is then prompted to paste this command into a trusted system interface, such as a terminal or command prompt, and press Enter. This technique is insidious because it leaves no traditional forensic footprint: no vulnerability for scanners, no attachment for email gateways, and no download for browser reputation checks. The command is executed by an authenticated, interactive user within a native, signed binary, mimicking legitimate administrative actions. ### A Rapidly Growing Threat The report highlights the alarming prevalence of **ClickFix**: * **Microsoft** attributed 47% of initial-access cases handled by its **Defender Experts** team in 2025 to **ClickFix**, surpassing conventional phishing. * **ESET** recorded a 517% surge in the first half of 2025, followed by another 108% increase between the second half of 2025 and the first half of 2026. * **MITRE** recognized this behavior in March 2025, assigning it a dedicated sub-technique: **T1204.004**, **User Execution: Malicious Copy and Paste**, affecting Windows, macOS, and Linux platforms. **CTM360**'s report consolidates independent analyses, including a campaign-level review of over 17,000 infected URLs and a host-level examination of a compromised **WordPress** site. These analyses trace the full attack path from an injected page to an information stealer like **Vidar Stealer** running within a signed Microsoft process. ### Key Findings for Defenders The report identifies three critical findings that demand attention from security professionals: #### The Infrastructure Is Built to Survive Takedown **ClickFix** leverages resilient infrastructure designed to evade takedowns. Malicious scripts on compromised websites do not contain attacker domains directly. Instead, they make a read-only call to a smart contract on the **Polygon blockchain** (a technique known as **EtherHiding**). This contract returns an encoded string that decodes to the current lure hostname. Attackers can update this on-chain value, instantly redirecting all infected sites to new lure hosts. This decentralized approach bypasses traditional takedown mechanisms, as there are no registrars or hosting providers to contact. Similar tactics are used further down the chain, with **Telegram** channel descriptions and **Steam** profile pages resolving malware command-and-control (C2) addresses. This architectural design ensures that no single point of failure can disrupt the operation, making domain blocking largely ineffective as lure domains rotate faster than blocklists can be published. #### Targeting is Server-Side, Per-Visitor, and Hostile to Analysis **ClickFix** campaigns employ sophisticated server-side targeting. The lure page reports the visitor's operating system and version to the operator, who then delivers a tailored configuration. While **Windows** is currently the primary target, macOS and Linux landing pages are built and held in reserve, demonstrating a broader capability. Crucially, a traffic distribution system (TDS) polls the operator every 1.5 seconds and can silently mark a session as 'verified,' bypassing the malicious instruction for researchers, sandboxes, and crawlers. This ensures that only intended targets receive the lure, making analysis and detection incredibly challenging. #### The Payload Is Gated on Machine Identity The third significant finding reveals that the payload delivery is contingent on machine identity. The dropper recovered from live hosts embeds a hardware and account fingerprint (including machine GUID, volume serial, computer name, BIOS manufacturer, system model, GPU, and username) directly into the download path. This allows the C2 server to identify the victim's machine *before* delivering any payload, enabling highly targeted delivery or complete evasion for non-target systems. This means detonation-based verdicts from sandboxes are structurally unreliable. The absence of a payload in a sandbox environment does not indicate a site is clean, as the sandbox likely received machine-specific content that was not the actual malware. Controls relying on recognizing attacker infrastructure are quickly rendered obsolete. Instead, controls that restrict what an interactive user can execute maintain their value across all known and future variants. ### The WordPress Connection **WordPress** sites frequently serve as the substrate for **ClickFix** delivery. These legitimate domains, with valid certificates and genuine traffic, offer attackers a cheap way to leverage established reputation. The report reveals that on one examined host, the loader was not injected into a page, post, or theme file. Instead, it was appended by PHP to *every dynamic response* (HTML, RSS, JSON alike), indicating a must-use plugin that loads on every request and remains hidden from the plugin list. This was accompanied by roughly two dozen scripted backdoor administrator accounts. Common cleanup efforts, such as deleting visible scripts or rogue accounts, are often ineffective as they fail to address the root cause. ### Effective Remediation Strategies The report suggests remediation efforts should focus on four critical choke points: 1. **Clipboard-write capability:** A page must be able to write to the clipboard. 2. **Interpreter access:** A user must be able to open an interpreter. 3. **Internet connectivity:** The interpreter must be able to reach the internet. 4. **Persistence and exfiltration:** Something must persist, collect, and exfiltrate data. Two controls are highlighted as severely underutilized: blocking clipboard-write by default in managed browsers effectively closes the entire attack vector at the initial stage.