A ClickFix attack is spreading through fake error messages and CAPTCHAs, tricking employees into pasting a command that steals passwords, login sessions, and company files. Here’s what SMB owners need to know.
If someone on your team has ever seen a pop-up telling them to “fix” a problem by copying a command and pasting it into a Windows box, you’ve already been in the blast radius of a ClickFix attack. Security researchers say campaigns using this exact trick are actively spreading a data-stealing program called ACR Stealer, and it’s pulling saved browser passwords, login sessions, PDFs, and Microsoft 365 files straight out of infected computers. No software bug is involved. It works because a person was talked into typing something they shouldn’t have.
How it works
The trick starts with bait: a fake error message, a fake “verify you’re human” check, or a fake page pretending to be a legitimate download. In one documented case, a page was dressed up to look like the website for Claude, a well-known AI assistant. It’s worth being clear here: that AI company didn’t do anything wrong and wasn’t breached. Attackers simply copied its look to seem trustworthy, often reaching victims through malicious ads or manipulated search results.
The fake page tells the visitor to press a key combination, which secretly copies a command onto their clipboard, then walks them through pasting it into the Windows “Run” box and hitting Enter. That one paste and Enter action is the entire break in. Everything after that happens automatically and silently.
From there, researchers describe two versions of what happens next. In one, the command quietly downloads what looks like an ordinary photo from an image hosting site. Hidden inside that image’s pixels is the actual malicious program, which is unpacked and run entirely in the computer’s memory, leaving little trace on the hard drive. In the other version, the command pulls a file down from a remote network location and disguises it as an ordinary Windows update, then sets up a hidden scheduled task so it keeps running even after a restart, while also erasing signs of its own activity.
Either way, the end result is the same. It goes into Chrome or Edge, grabs saved usernames, passwords, and the “logged in” tokens that let someone access your accounts without a password at all, then grabs PDFs and Microsoft 365 files sitting on the desktop or synced through OneDrive and SharePoint.
What the attackers want
The people behind this haven’t been publicly named, and the researchers are careful not to guess. Microsoft, whose security team documented the campaigns, ties the activity to this stealer program based on its behavior, but stops short of naming who’s operating it. It’s also worth noting that the report doesn’t say how many businesses have been affected or give a specific victim count. It only describes the technique and confirms the activity has been increasing.
What is clear is the goal: stolen passwords, active login sessions, and business documents, most likely for resale or further use in follow on fraud, account takeover, or business email compromise. The report doesn’t spell out what happens to the data after it’s stolen.
What this means for you
Train your team on the “paste a command” red flag. No legitimate website, error message, or CAPTCHA will ever ask someone to open the Windows Run box and paste something in. If a pop up asks for that, it’s a scam. Close it and don’t paste anything.
Restrict who can use the Run box and scripting tools. Your IT provider can lock down or remove access to the Run prompt and restrict tools like mshta.exe, PowerShell, and Python from running content downloaded from the internet, which closes off this entire attack path.
Treat stolen login sessions as more than a password problem. Because this attack steals active login tokens, changing a password alone may not be enough. Sessions may need to be forcibly revoked, which is a step your IT provider or software vendor can take.
Watch for suspicious network and scheduled task activity. Unusual outbound connections to unfamiliar file sharing or image hosting addresses, or new scheduled tasks disguised as software updates, are signs worth having your IT team investigate.
Double check anything you download, even from familiar looking brands. Fake pages impersonating trusted software, including AI tools, are part of this campaign, so verify you’re on the real, official site before downloading or pasting anything.
If any of this sounds like something your team might not catch on their own, or you’re not sure whether your current defenses would stop a ClickFix attack, it’s worth having a cybersecurity provider take a look at your setup rather than finding out the hard way.