Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them

Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. The meeting never starts. The command does something else entirely. This is ClickFix, a social engineering technique that turns the victim into the mechanism for executing an attack. CrowdStrike Intelligence has observed adversaries including STARDUST CHOLLIMA and VOODOO BEAR using ClickFix in real-world operations. Further, the CrowdStrike 2026 Global Threat Report documented a 563% increase in incidents involving fake CAPTCHA lures in 2025. ClickFix is effective because it exploits something security teams cannot simply patch: a user's instinct to solve a problem. In this blog post, we explain what ClickFix is, how it works, and…