ClickFix Attack: Huntress Traces Fake 'Verify You Are Human' Prompts to Domain Controller Break-Ins, and How to Block the Paste
Huntress traced ClickFix fake verification prompts to three intrusions that reached or targeted company domain controllers. What is confirmed, what is not, and how to block the paste this week.
Where Worldwide
On this page 9 sections
Attackers are putting up fake "verify you are human" pages that get employees to paste a command into Windows. Huntress now reports that some of those single pasted commands led all the way to a company's domain controller, the server that controls every login on the network. If your staff can open the Run box or PowerShell on a work PC, this trick can do far more damage than stealing one browser's saved passwords.
What Huntress reported about ClickFix
On Tuesday, November 10, 2026, security firm Huntress published "Beyond the clipboard: The evolving tradecraft of ClickFix," based on intrusions its team investigated. ClickFix is a social engineering trick, not a software flaw. A web page shows a fake check, often styled to look like Cloudflare, and tells the visitor to press a few keys, paste a command and press Enter. The victim runs the attacker's code themselves.
Huntress says ClickFix was best known for delivering scripts, loaders and password stealers. It is now also turning up in attacks that set up persistence, move from machine to machine and reach domain controllers.
Confirmed in Huntress's reports:
- In three separate intrusions, a ClickFix command on one PC was the starting point for an attacker who later reached or targeted a domain controller.
- The attackers moved around using ordinary Windows administration tools: PsExec, RDP, WinRM, WMIExec and SMBExec.
- The lures came from paid search ads, poisoned search results, a hacked legitimate website and, in one campaign, ChatGPT's Custom GPT feature.
Not confirmed: Huntress calls the technique widely used but gives no overall count or percentage of incidents. Some news coverage has added figures that do not appear in the Huntress report, so we have left them out.
How a ClickFix attack starts
- Malvertising: a user searched Bing for "Westlaw," clicked a paid ad and was sent through a look-alike domain to a fake sign-on page showing ClickFix steps.
- SEO poisoning: searches for LinkedIn and real estate led to spoofed sites with a fake Cloudflare checkbox.
- A hacked business website: a dental practice's site was briefly compromised, and its cookie consent pop-up led to a fake Cloudflare check.
- Trusted platforms: one campaign used a ChatGPT Custom GPT to get users to download a Windows installer that dropped a remote access tool.
The pages are getting more convincing. Huntress shows commands that open a terminal printing colored "verification" messages. One script drew a full fake "Cloudflare Security Challenge" window with progress bars while the payload downloaded.
ClickFix to domain controller: the incidents
| When | What the pasted command led to | How the attacker moved | How far it got |
|---|---|---|---|
| February 2026 | A silent msiexec install of the Matanbuchus 3.0 loader, then AstarionRAT | PsExec, RDP | A backup domain controller, under 40 minutes after the first lateral hop; the attempt on the primary domain controller failed |
| May 2026 | Potemkin loader, RMMProject and EtherRAT, on a PC with no security agent | WinRM, WMIExec, SMBExec, Chisel tunnels | More than 11 hosts, including the domain controller |
| Early September (year not stated) | cf_verify.zip, holding 1.bat, the legitimate CertEnrollCtrl.exe and a malicious CertEnroll.dll that it side-loads; a Run key and scheduled task named CertEnrollCtrl_Y0db6oZq9 | WinRM, reverse SSH tunnels | The primary domain controller, where the attacker created a new user |
| Not dated | DuskDesk, a Node.js remote access tool posing as remote management software (two incidents) | None described | Not stated |
The September case shows why lists of known file names go out of date quickly. The attacker did not rely on a dedicated remote access tool as the main foothold. Instead, files staged on disk, including a malicious DLL loaded by a legitimate program, ran PowerShell reconnaissance of Active Directory. A later stage dropped an SSH key and opened a reverse SSH tunnel to an outside server. Huntress advises watching the sequence of activity rather than relying only on hashes, domains or file names.
What is not known
- Huntress does not name the victims, their industries or their countries.
- It does not say whether data was stolen or ransomware deployed.
- It does not tie the incidents to one group, and the payloads differ.
- The September and undated incidents have no year in the report.
Why ClickFix matters for a company network
Many businesses run Windows PCs joined to Active Directory. Whoever controls the domain controller can create accounts, push software to every PC and lock everyone out. ClickFix needs no unpatched server and no email attachment. It needs one employee who trusts a web page, and a PC that lets that person open PowerShell or the Run box. The May case also shows the cost of a gap in coverage: the first PC had no endpoint agent, which Huntress says gave the attacker uncontested time.
How to block ClickFix: what to do this week
| Action | How |
|---|---|
| Teach one rule | No real website, CAPTCHA or "verification" asks you to paste a command into Run, PowerShell or a terminal. Report any page that does. |
| Turn off the Run box | Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > "Remove Run menu from Start Menu." This also blocks Win+R. |
| Warn on multi-line pastes | Set Windows Terminal to warn when pasted text contains more than one line. |
| Block programs in user folders | Use application control (AppLocker or Windows Defender Application Control) to stop executables and DLLs from running in Temp, AppData and other folders users can write to. |
| Remove local admin rights | Everyday accounts should not be local administrators. |
| Cover every machine | Confirm every workstation and server runs your endpoint agent with tamper protection on. |
| Alert on the chain | A browser or user process launching cmd.exe, PowerShell or Windows Terminal; encoded PowerShell; execution policy bypass; new scheduled tasks or Run keys; unexpected outbound SSH. |
| Watch admin tools | Alert on PsExec running from odd folders such as C:\ProgramData, and on "net user" or "net localgroup" adding accounts. Turn on PowerShell script block logging. |
How to check if a ClickFix command already ran
- Check the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU). Microsoft notes it keeps a history of commands typed into the Run dialog. Look for PowerShell, msiexec or long encoded strings.
- List recently created scheduled tasks and Run keys. Huntress saw names such as CertEnrollCtrl_Y0db6oZq9, SysyService and DuskDesk, but new attacks will use new names.
- Look for randomly named folders in C:\ProgramData and ZIP files in user Temp folders.
- On domain controllers, review newly created accounts and outbound SSH connections.
ClickFix questions people are asking
What is a ClickFix attack?
A fake web prompt, often a "verify you are human" check, that tells you to paste and run a command. The command downloads malware or opens a way in for the attacker.
Is ClickFix a virus or a vulnerability?
Neither. It is a social engineering technique. There is no patch, because the user runs the command themselves.
Can antivirus stop ClickFix?
It helps, but it is not enough on its own. The commands run through built-in tools like PowerShell and msiexec, and the payloads and file names keep changing. Use antivirus together with application control and alerts on the chain of activity.
How do I disable the Run dialog with Group Policy?
Enable "Remove Run menu from Start Menu" under User Configuration > Administrative Templates > Start Menu and Taskbar.
What if an employee already pasted a command?
Disconnect that PC from the network and reset the user's passwords from a clean device. Check for new accounts, scheduled tasks and Run keys. Then bring in incident response, because in these cases the attackers moved on to other machines.
The bigger lesson
ClickFix works because it turns a trusted employee into the installer. Training helps, but the fix that lasts is a network where one pasted command cannot run from a user folder, cannot get admin rights and cannot reach the domain controller without someone noticing.
Want that built into your systems? See security hardening or get a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Huntress: Beyond the clipboard, the evolving tradecraft of ClickFix; Huntress: ClickFix to Matanbuchus 3.0 and AstarionRAT; Huntress: ClickFix, Potemkin, RMMProject and EtherRAT; Microsoft: Think before you ClickFix.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
Turla Cereal Malware: Russian Spies Turned Government Exchange Servers Into Hidden Control Hubs, What Is Confirmed and What to Check on Yours
ESET says Turla hid a new toolset called Cereal on government Exchange servers in Kazakhstan and Romania and u...
