ClickFix Technique Evolves into Sophisticated Subscription Service, Bypassing Traditional Defenses
A new report details how the ClickFix technique, which hijacks trusted websites to deliver malware via copy-paste commands, has evolved into a resilient subscription service with on-chain infrastructure, posing a significant threat to enterprise networks.
The ClickFix technique has rapidly emerged as a dominant initial-access vector for enterprise network intrusions, bypassing traditional security measures by avoiding exploits, attachments, or file-based malware. Initially a novel approach, it has transformed into a sophisticated, subscription-based service with robust infrastructure, including on-chain components, and has even attracted state-sponsored users, according to a recent report by CTM360.
This method circumvents conventional defenses by presenting users with seemingly legitimate problems, such as unresolvable verification checks or document errors. The "fix" is then silently copied to the user's clipboard, prompting them to paste a command into a trusted system interface. This "malicious copy and paste" behavior, now recognized by MITRE as T1204.004, leverages the user's own authenticated actions within native, signed binaries, making it exceptionally difficult to detect and block.
Microsoft has reported that ClickFix accounted for 47% of initial-access cases handled by its Defender Experts team in 2025, surpassing conventional phishing. Security firm ESET has observed a dramatic increase, noting a 517% rise in the first half of 2025 and a further 108% increase between the second half of 2025 and the first half of 2026, underscoring its growing prevalence and effectiveness.
CTM360's analysis, which consolidates primary research on over 17,000 infected URLs and a deep dive into a single compromised WordPress site, reveals a resilient infrastructure designed to thwart takedown efforts. The injected script on compromised websites does not contain attacker-controlled domains. Instead, it utilizes a technique called EtherHiding, where a browser makes a free, read-only call to a smart contract on the Polygon blockchain, which then returns the current lure hostname.
This on-chain resolution mechanism allows operators to update lure domains by modifying a single on-chain value, propagating changes to all infected sites within seconds. This architecture eliminates traditional points of failure, such as registrars or hosting providers, making blocking malicious domains largely ineffective as a defense strategy. The use of legitimate RPC providers further complicates efforts to disrupt the infrastructure.
Further enhancing its resilience, the ClickFix infrastructure employs multiple independent resolution mechanisms. Telegram channel descriptions and Steam profile pages are used to resolve the malware's command-and-control (C2) address, ensuring that the operation can continue even if one resolution method is disrupted. This multi-layered approach is a deliberate design choice to prevent single points of failure.
The targeting and delivery of the ClickFix payload are also highly sophisticated. The lure page reports the visitor's operating system and version to the operator, who can then dynamically configure which platforms to attack and which landing page to serve. While Windows has been the primary target, mature macOS and Linux variants exist, indicating the technique's cross-platform capabilities. A traffic distribution system silently marks sessions as "verified" for legitimate targets, while researchers and sandboxes receive clean pages, making analysis challenging.
Finally, the payload itself is gated on machine identity. The dropper recovers from live hosts includes hardware and account identifiers in the download path, allowing the C2 server to serve machine-specific content or nothing at all. This prevents sandboxes from reliably detonating the actual payload delivered to victims, rendering detonation-based security verdicts structurally unreliable and undermining traditional detection methods that rely on observing malicious payloads.