Observe ClickFix in the wild.

What is a ClickFix attack?

ClickFix tricks you into infecting your own computer. It does not ask you to download and run a file, the kind of thing antivirus tools watch for. Instead it gets you to paste and run a command yourself.

The lure looks like a routine hurdle: a “verify you’re human” check, a broken video player, a fake browser or driver update, a DocuSign- or Cloudflare-style prompt. Clicking through does three things at once:

1. A malicious command is silently copied to your clipboard.
2. On-screen instructions tell you to press Win+R (or open a terminal) and paste.
3. You press Enter, and the command, usually PowerShell, runs with your own permissions. It quietly fetches and launches the real payload.

Nothing was ever “downloaded” through the browser, and you typed the keystrokes yourself. That is why it slips past defenses built to catch file downloads or blocked scripts. It works because it borrows the visual language of routine, harmless prompts and asks you to do something that feels like troubleshooting, not installing software.

What this dashboard shows

Located ClickFix lures only: sites where we captured runtime proof of the technique above (the staged clipboard command, the paste-and-run instructions), not just suspicious page text. Each report maps the attack chain: lure surface, clipboard staging, delivery hosts, and payload evidence captured during the scan.

clickfix.observer is made by Passguard, a Dutch stealer intelligence platform founded in 2021 and focused on detecting and responding to infostealer infections. Passguard gives security teams access to data from compromised devices, including stolen credentials, active sessions and cookies, so they can spot infections early, revoke access and prevent further misuse.

ClickFix is one of the most common ways infostealers get onto a device today. This observer tracks the lures that start those infections, so the same team that works with the stolen data can see where it comes from.