ClickFix Attack Evolves: Weaponized Videos Trigger Self-Infection Tactics

ClickFix attacks have surged in sophistication, with weaponised instructional videos now prompting victims to self-infect their devices, bypassing traditional awareness efforts that focus on clicks, downloads and phishing sites.

In a London threat briefing and a Push Security webinar, researchers highlighted how these campaigns have evolved not only in page design but also in delivery and payload execution, including a highly convincing Cloudflare-themed lure that features an embedded video, a ticking countdown and a live “users verified in the last hour” counter. The technique often relies on JavaScript to copy malicious commands to the clipboard, driving a self-infection process after users are tricked into pasting and running the code.

Four out of five ClickFix lures intercepted began with poisoned Google search results or malvertising ads, and attackers are increasingly exploiting CMS vulnerabilities to distribute payloads beyond email. According to Microsoft’s 2025 Digital Defense Report, ClickFix was the leading initial access technique in 2025, constituting 47% of observed attacks, underscoring the need for browser-side controls in addition to endpoint security, as noted by Push Security.