- Published on
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
- Authors
- Name
- DeepHorus
A security researcher has analyzed nearly 3,000 live ClickFix payloads, revealing that the deceptive malware delivery technique has evolved into an API-driven service that generates unique disguises for each victim. Bert-Jan Pals presented his findings at OrangeCon in early June and published the details on June 30, exposing how ClickFix platforms now serve payloads on demand. The research also uncovered a new delivery method designed to evade Windows' script-scanning defenses, marking a significant escalation in this threat.
ClickFix tricks users into running malware manually by displaying fake CAPTCHA or error pages. Hidden JavaScript copies a malicious command to the clipboard, and victims are instructed to paste it into a Run box or terminal, executing the payload themselves. This approach avoids exploits and leaves no file for traditional antivirus to flag, making it difficult for conventional security tools to detect.
The technique has seen explosive growth. ESET measured a 517% increase from late 2024 into early 2025, while Microsoft's 2025 Digital Defense Report attributed 47% of initial-access cases handled by its Defender Experts team to ClickFix. The method has even earned its own MITRE ATT&CK entry, T1204.004.
Pals discovered that ClickFix pages now pull commands from backend servers that operate like an on-demand service. These servers check access tokens, log callers, and return freshly scrambled payloads each time. When Pals requested 100 payloads from one server, he received 100 different ones, wrapped in varying combinations of Base64, AES, TripleDES, Rijndael, and Deflate encodings—though they all unpacked to the same PowerShell script. The platform also serves lures in 25 languages and matches commands to the victim's operating system.
The second finding pertains to a new delivery vector targeting the Downloads folder. Instead of copying a malicious command directly, the page downloads a file and places a harmless-looking orchestrator command in the clipboard. This command moves the downloaded file, unpacks it, and runs the script inside, bypassing Microsoft's Anti-Malware Scan Interface (AMSI). The observed clipboard command used PowerShell and tar to extract a ZIP file and execute a PS1 script, leaving minimal forensic traces. Additionally, newer lures direct victims to open Windows Terminal via Windows+X instead of the Run box, avoiding the RunMRU registry key that investigators check.
The implications are significant: ClickFix has become more scalable and harder to detect. State-backed threat actors have already adopted ClickFix; Proofpoint linked groups such as APT28, MuddyWater, and Kimsuky to its use, and North Korean operators built a fake-job variant called "ClickFake Interview" targeting cryptocurrency. Pals warns that the core payload will likely start varying per victim in the future, further complicating detection. As defenders adapt, this attack technique will continue to evolve, posing an ongoing challenge for cybersecurity.
