![\"Screenshot](\"https:\/\/brocku.ca\/brock-news\/wp-content\/uploads\/2026\/03\/ClickFix2-copy.png\")
An example of a pop-up message used in a ClickFix attack.<\/p><\/div>\n
\u201cClickFix\u201d or \u201cFileFix\u201d scams are a type of social engineering attack that manipulate users into unknowingly running harmful commands on their devices.<\/p>\n
These attacks often appear as fake system or browser error messages \u2014 such as a CAPTCHA message to verify the user is human, a virus alert, an error message or a browser update notice \u2014 that instruct users to follow a series of steps to fix what appears to be a problem. Instead, these steps actually bypass normal security protections and install malicious software on the device.<\/p>\n
Steps in a ClickFix attack often include the user being instructed to click a button that secretly copies harmful command to their clipboard, open a legitimate system tool such as the Windows Run box and press CTRL + V and then the Enter key, which pastes the harmful command that launches a script.<\/p>\n
The launched script can install malware to steal personal data, give attackers remote access to their device or cause other harm. Because the command is run through a standard system tool, it often goes undetected by antivirus software and browser security warnings.<\/p>\n
To protect themselves from ClickFix attacks, users should:<\/p>\n
- \n
- Be wary of messages that create a sense of urgency to act quickly, ask for unexpected steps or seem unusual, no matter how real the page appears.<\/li>\n
- Close any suspicious website pop-ups immediately without clicking on them.<\/li>\n
- Never copy and paste commands from unknown or suspicious sources. Legitimate websites or services will never ask users to open a system tool such as Run, PowerShell, or Terminal and paste code to fix a problem or verify their identity.<\/li>\n
- Verify information in a suspicious or unexpected pop-up by going directly to the organization\u2019s official website or contacting it using a trusted method.<\/li>\n
- Keep systems and apps up to date.<\/li>\n
- Use trusted antivirus or security software that can detect unusual activity like suspicious commands.<\/li>\n
- Report unexpected error or security messages to the ITS team.<\/li>\n<\/ul>\n