Cybercriminals keep getting better at blending into the software you use every day.
Over the past few years, we’ve seen phishing pages that mimic banking portals, fake “your PC is infected” alerts, and sketchy “human verification” screens that try to trick people into running commands they should never touch. Now there’s another variation spreading: ClickFix-style attacks that disguise themselves as a Windows Update.
ClickFix isn’t one single group or malware family—it’s a social-engineering technique used in multiple campaigns. The common thread is simple: the attacker tries to convince you to run a command yourself, bypassing a lot of automated security controls in the process.
How the fake Windows Update trick works
In recent waves, researchers have spotted full-screen web pages that look like a legitimate Windows update screen—complete with familiar wording and progress indicators. The goal is to make you treat what’s really a browser tab as if it’s part of the operating system.
If you’re on Windows, the page typically instructs you to:
- open the Run dialog (Win + R),
- paste a command (often already copied to your clipboard),
- and press Enter to “finish” a critical security update.
That pasted command is the trap. It kicks off an infection chain designed to quietly pull down a malware “dropper,” which then installs the real payload—often an infostealer built to steal passwords, browser cookies, and other sensitive data.
What happens after you paste the command
This is where ClickFix campaigns get technical—and harder to spot at a glance.
One common flow uses Windows utilities and scripts to fetch and run the next stage. Analysts have described chains where:
- a script pulls down additional code from a remote server (often with changing URL paths),
- PowerShell runs heavily obfuscated commands to make analysis harder,
- and the malware decrypts and loads more components in memory.
The end result is the same: your machine starts running attacker-controlled code because you were tricked into launching it.
Why security tools can struggle with this one
One of the nastier tricks in recent ClickFix-style activity is hiding the next stage inside what looks like an ordinary PNG image.
This uses steganography—a method for embedding data inside normal-looking content. The image appears harmless if you open it, but the attacker’s script knows how to pull hidden bytes out of the pixel data, decrypt them, and rebuild the next stage directly in memory.
In practical terms, that can make the attack file-light and harder for basic, signature-only scanning to catch. (Modern endpoint tools can still detect suspicious behavior—but the technique is designed to reduce obvious artifacts.)
What malware does it install?
Recent activity tied to ClickFix lures has delivered well-known infostealers such as LummaC2 and Rhadamanthys variants. These are built for quiet data theft—credentials, session tokens, and other browser-stored secrets—so attackers can hijack accounts with minimal noise.
7 steps you can take to protect yourself
The most effective defense is simple: don’t let a webpage talk you into doing the attacker’s job for them.
1) Never run commands you didn’t request
If a site tells you to paste something into Run, PowerShell, or Terminal, treat it as a bright-red warning sign. Legit Windows updates don’t require copying commands from a web page.
2) Keep Windows updates inside Windows
Updates should come from Settings > Windows Update or official system notifications. A browser tab claiming to be a Windows update is not normal update behavior.
3) Use reputable security software (and keep it updated)
Look for tools that go beyond file scanning—features like behavioral detection, script monitoring, and exploit protection can help spot suspicious activity early.
4) Use a password manager and enable MFA
A password manager helps you avoid password reuse and can make phishing easier to spot when autofill doesn’t trigger. Add multi-factor authentication (preferably an authenticator app or security key) wherever you can.
5) Reduce exposed personal info where possible
Data broker opt-outs and privacy services can help shrink your public footprint. Results vary, but reducing exposed emails and phone numbers can lower the volume of targeted scam attempts.
6) Check URLs before trusting what you see
A convincing layout means nothing if the domain is wrong. Look for misspellings, extra characters, or unfamiliar top-level domains.
7) Exit suspicious full-screen pages immediately
Fake update pages often use full-screen mode to hide the browser UI. Hit Esc, Alt+Tab, or F11 to exit full screen. If you interacted with the page, run a full security scan and change passwords on important accounts from a clean device.
Key takeaway
ClickFix works because it relies on user interaction. Nothing happens until someone follows the on-screen instructions and runs the command.
That’s why the fake Windows update lure is so effective: it imitates something people are trained to trust. The technical chain behind it can be complicated—but the entry point is straightforward. Attackers don’t need you to be careless. They just need you to be in a hurry.