ClickFix: When Phishing Stops Being About Clicking

Why this emerging social engineering technique challenges the way we think about security awareness.

And honestly? It made me stop for a second.

Not because it was the most advanced attack technique I had ever seen. Not because it involved some complicated vulnerability.

Actually, the opposite. It was simple. Almost too simple.

And that was the part that stayed with me.

Because for years, one of the biggest lessons in security awareness has been:

"Don't click suspicious links."

But ClickFix almost feels like it looked at that advice and said:

"Okay. What if I don't need you to click anything?"

That was the moment I started thinking about how much social engineering has changed.

My understanding of phishing has changed

Before getting into cybersecurity, when I heard the word phishing, I usually imagined the same things.

• A suspicious email.
• A fake login page.
• An attachment you definitely shouldn't open.
• The obvious warning signs.

But the more I learn through my work experience, the more I realise that attacks are not always about breaking technology.

Sometimes, they are about understanding people.

• How we react when something looks urgent.
• How we respond when something appears broken.
• How quickly we follow instructions when we think we are fixing a problem.

And that's what makes ClickFix interesting.

So what actually happens in a ClickFix attack?

Imagine you are browsing a website. Instead of loading normally, a message appears.

Maybe it says your browser needs an update; maybe it says a verification failed ; maybe it looks like a normal CAPTCHA or security check.

Nothing immediately screams:

"This is an attack."

Then you see instructions. Press a shortcut. Copy a command. Paste it somewhere. Run it.

It feels like troubleshooting.

Except the command is not fixing anything.

The user has unknowingly become part of the execution process.

• No malicious attachment.
• No obvious malware download.
• No traditional "click here to get infected" moment.

And that is what made me think.

Because the attack is not only technical.

It is psychological.

The part I find interesting as someone learning cybersecurity

One thing I noticed after starting my internship is that I don't look at attacks the same way anymore.

When I read about something new, my first thought is not only:

"How does this work?"

It becomes:

"What would this actually look like inside a company?"

Because real incidents rarely arrive with a clear label.

Nobody gets an alert saying:

"Congratulations, this is a ClickFix attack."

It is usually small pieces of information. A user saying something strange happened. PowerShell running unexpectedly.

A process appearing where it shouldn't. Network activity that looks unusual.

Individually, maybe nothing looks dramatic.

Together? They start telling a story.

And I think that is one of the things I find fascinating about cybersecurity.

The investigation is not always about finding one obvious answer.

Sometimes it is about connecting small things that don't make sense until you put them together.

It also made me question security awareness training

One thing I kept thinking about was this:

Have we been preparing people for the attacks that exist today?

Or the attacks that existed when our training was created?

Because telling people not to click suspicious links is still important.

• But what happens when the attacker doesn't need a click?
• What happens when the attacker asks someone to do something that feels helpful?

"Your browser is broken. Follow these steps."

"Your verification failed. Run this command."

"Your system needs fixing. Paste this."

The dangerous part is that it doesn't feel like an attack.

It feels like solving a problem.

Cybersecurity keeps reminding me that people are the centre of everything

The more I learn, the more I notice something. Attackers are not only studying technology.

They are studying behaviour. They understand what makes people curious.

• What makes people panic.
• What makes people trust something that looks official.

ClickFix is a good reminder that cybersecurity is not just about tools, malware, or vulnerabilities.

It is also about understanding humans.

And honestly? That might be one of the hardest parts to defend.

The interesting thing about cybersecurity is that every person notices something different.

A SOC analyst might see the process tree.

A security awareness team might see the human behaviour behind it.

Someone new to cybersecurity might simply wonder if they would have noticed the warning signs.

And honestly, I think every perspective adds something.

©