Skip to content
ClickFix attacks have become a silent but effective threat across industries, from retail and financial services to government and technology. Unlike malware dropped through downloads, ClickFix relies on tricking users into running malicious commands themselves under the guise of “fixing” a problem. That renders it especially dangerous and elusive, as it leverages human behaviour rather than vulnerabilities in software. These types of attacks are on the rise and have been since 2024.
What’s New?
Typically, with click-fix style attacks, users are instructed to run PowerShell, Command Prompt, or execute commands via the Run dialogue in Windows, often via shortcut combinations on the keyboard, such as pressing the Windows key + R.
According to researchers at Huntress, when the victim goes to the malicious site, they’re prompted with a fake Cloudflare turnstile. When the verification button is pressed by the victim, it leads to Windows File Explorer opening via the search-ms URI handler. This file explorer window connects back to an attacker-controlled SMB share with a shortcut icon mimicking a PDF file.
This shortcut was seen to be malicious upon activation. The shortcut initiated two processes: downloading the real AnyDesk installer (to mask activity) and dropping an MSI package disguised as a PDF. This MSI harvests the victim’s machine name via the %COMPUTERNAME% environment variable and ultimately installs MetaStealer, a credential and file‑stealing infostealer.
The victim user may be none the wiser, as they have retrieved the AnyDesk utility and it appears to be successfully installed from the victim’s perspective.
Why This New Variant Matters
- Blends trusted names with social engineering, using AnyDesk, a known brand, to lower suspicion.
- Shifts execution method from Command prompt, PowerShell and run dialogue.
- Enables stealthy reconnaissance via hostname collection and implements an info stealer on the target system.
How to defend against ClickFix attacks
User Training: Teach staff to suspect prompts like “verify you are human” or “fix errors” that ask them to copy-paste commands. Simulate such tactics in phishing exercises.
Technical Controls:
- Restrict use of Run, PowerShell, and scripting tools for non-admin accounts.
- Deploy URL and DNS filtering to block known malicious domains or suspicious redirections.
- Monitor for unusual behaviours, such as search-ms protocol invocation or unexpected MSI executions.
- Block SMB on the network perimeter.
Detection and Response:
- Utilise threat intelligence to flag fake domains like anydeesk[.]ink.
- Employ EDR to spot abnormal filesystem or command activities, especially from SMB shares.
- Multi-Factor Authentication: Hardens accounts against credential theft, even if MetaStealer is deployed.
Reference: https://www.huntress.com/blog/fake-anydesk-clickfix-metastealer-malware
