ClickFix & FileFix: How a Copy-Paste Trick Became 2025’s Top Social Engineering Threat

ClickFix, also known as ClearFix, is a modern evolution of phishing that surfaced in October 2023 and had detections surge by more than 500% over six months, making it one of the fastest-growing social engineering threats by 2025. A newer offshoot, FileFix, shifts the attack surface from the Windows Run dialog to the Windows File Explorer address bar, using JavaScript to silently copy a PowerShell command into the clipboard and prompting victims to paste a file path to execute malware.

Victims are lured via verification pages, CAPTCHA checks, or short-form videos, with the malicious commands running from Run, Win+X, or via mshta, and final payloads including infostealers, loaders, RATs, and rootkits. The threat actor landscape includes opportunistic criminals and APT groups such as MuddyWater and APT28, with a reported example of a campaign impersonating a telecom provider to deliver the AMOS stealer, and another using TikTok to spread Aura Stealer.

According to Unit42, ClickFix is now sold as a cybercrime service with kits offering templates, language options, evasion features, and obfuscated command generation, enabling rapid spread across Dark Web markets and Telegram channels.