ClickFix

Your bookkeeper is trying to open a shared document. The page loads, then stops.
"Verification failed. To prove you're human, complete these three steps."
Press the Windows key and R. Press Ctrl+V. Press Enter.
She does it. The page refreshes, the document opens, and she goes back to work. Nothing looks wrong.
Nothing looked wrong on her screen. But in those few seconds, a command she never saw — one the page had quietly copied to her clipboard for her — ran on her computer. By the time she finished her coffee, the passwords saved in her browser and the tokens that keep her signed into your email were sitting on someone else's server.
It's called ClickFix, and it is everywhere right now. Just this week, researchers found compromised business websites serving fake "checking your browser" pages, and a web address referenced in more than 1,700 public code projects quietly bought by attackers to run the same play.
As an MSP, here's what makes this one different from most of what we see: it never asks you to download anything, and it never asks for your password. It asks you to fix a problem — and people are helpful. Your antivirus watches a built-in Windows tool do exactly what the user told it to do, and stays quiet.
The fix is almost embarrassingly simple.
👉 No legitimate website will ever ask you to copy and paste something into the Windows Run box, PowerShell, or a Mac Terminal — not to view a page, not to watch a video, not to prove you're human. Not once, not ever. If a site asks, it's an attack. Close the tab.
Say that sentence to your team this week. That's the whole defense.
In this week's video I walk through exactly how this plays out on a real screen — link in the comments 👇
Has anyone on your team run into one of these yet?
— Woodrow | Thought Streams Cybersecurity
#CyberSecurity #SmallBusiness #ClickFix #MSP