Attackers keep finding ways round security tooling by going through the user instead. ClickFix was one of the most effective examples — and researcher mr.d0x has since demonstrated a stealthier variant, FileFix, which abuses Windows File Explorer to achieve the same thing with even less friction.
Neither is a technical exploit. Both persuade the user to run the attack on the adversary's behalf, which is precisely why they work.
What is ClickFix?
ClickFix tricks users into copying and pasting a malicious command into the Run dialog, under the pretext of resolving an error or completing a CAPTCHA. A fake browser message says something like:
"To verify you are human, press Win + R, paste the copied command, and hit Enter."
The pasted command typically runs PowerShell or fetches a remote payload. Because the user initiated it, antivirus and SmartScreen have little reason to object.
Why it worked
- It relied on user trust and interface familiarity rather than any vulnerability.
- It required no file download, sidestepping a large share of endpoint defences.
- It exploited the ordinary human tendency to follow technical-looking instructions without verifying them.
FileFix takes it a step further
FileFix replaces the Run dialog with something that feels even more routine: the File Explorer address bar.
Rather than asking a user to open a Run box — which at least some people have been trained to treat as unusual — the attacker simulates a file-sharing or upload flow and asks the victim to paste a path into Explorer. Pasting into Explorer is something people do all day.
How the flow works
- A phishing page claims a file has been shared and needs to be accessed.
- A hidden file input on the page opens File Explorer, so the window appears as a natural consequence of the user's own click.
- The clipboard is quietly populated by JavaScript with the attacker's command.
- The instruction shows a plausible file path — something like an internal HR document — while what is actually on the clipboard is a command.
The user believes they are pasting a path. They are pasting an instruction.
Why FileFix is more dangerous than ClickFix
- Explorer is familiar. Pasting a path into File Explorer is normal behaviour in a way that pasting into the Run dialog never quite was.
- No Mark-of-the-Web. Nothing is downloaded, so there is no MOTW flag for Defender or SmartScreen to act on. A substantial part of Windows' modern defence against malicious files simply never engages.
- It stays inside trusted interfaces, so sandboxing and reputation checks have nothing to bite on.
- It is difficult to investigate afterwards. Distinguishing a malicious paste from a legitimate one is genuinely hard, because forensically they look the same.
Defending against FileFix and ClickFix
Train the specific behaviour, not the general principle
"Be careful online" achieves nothing here. The rule that works is narrow and memorable: never paste clipboard content into a system dialog or an Explorer address bar because a web page told you to. No legitimate website has ever needed that.
It is worth saying plainly to staff that a real error message never asks you to run a command, and a real CAPTCHA never involves the keyboard shortcut Win + R.
Detection
Monitor for:
- PowerShell or cmd spawned by
explorer.exe, or by a browser process such as Chrome or Edge. This is the highest-value detection for this technique — it is the moment the social engineering becomes execution, and it is rare enough in normal use to alert on. - Encoded or obfuscated command lines following a browser interaction.
- Websites writing to the clipboard via
navigator.clipboard.writeText, where your tooling can see it. - Outbound connections immediately following a shell launched from one of those parents.
Controls
- Application control — Microsoft Defender Application Control or equivalent, blocking unauthorised script execution. This is the control that stops the technique rather than noticing it.
- Constrain PowerShell for users who have no need of it, and enable script block logging for those who do.
- Clipboard permissions — limit or warn where a site attempts to write to the clipboard.
The wider point
ClickFix and FileFix belong to a category that is growing quickly: attacks with no exploit, no attachment and no download — nothing for a scanner to scan. The entire technical component is a string of text on a clipboard. Everything else is stagecraft.
That has two consequences worth planning around. Awareness training stops being a compliance exercise and becomes a genuine control, because the user is the only decision point in the chain. And detection has to move to the moment of execution — the shell that should not exist, launched by a parent that should never launch one — because there is nothing earlier to catch.