Skip to content
ClickFixReport
Every ClickFix campaign, on the record.

Public reference index

The public record of ClickFix campaigns

A free, permanent, fully attributed index of the ClickFix and fake-CAPTCHA campaigns that have been publicly reported, and of the indicators that came with them.

Did you just paste something?What to do now, in order. Takes about fifteen minutes.

ClickFix is a paste attack: a page persuades you to copy a line of text and run it yourself, in the Windows Run box or the macOS Terminal, usually behind a check claiming to verify you are human. Nothing is exploited — the reader does the work.

Defanged input works too — example[.]com and hxxps://example[.]com both resolve.

Where to go from here

Straight there: I pasted on Windows · I pasted on macOS · Is this CAPTCHA a virus?

The record, in numbers

Campaigns
61
Indicators
2,045
Domains
1,175

Counts are of published records only. Drafts, withdrawn entries and values we could not match against an archived source are excluded.

Latest campaigns

All campaigns →
  • Published 2026-10-11Status as last assessed: Active

    DOUBLECUP ClickFix loader service

    Reported by SOCRadar

    Targets Windows, macOS

    Indicators
    43
    First seen
    —
  • Published 2026-10-11Status as last assessed: Active

    WebDAV rundll32 ordinal ClickFix

    Reported by CyberProof

    Targets Windows

    Indicators
    7
    First seen
    —

What this is

A derivative work, and deliberately so. Other people do the research; we structure it, date it, and keep it findable.

  • Nothing is here unattributed

    Every record names the publisher who reported it and links their original above the fold, dofollow, with no redirect in between. We never reproduce a vendor’s prose. Editorial policy.

  • An indicator has to be in the source

    A value is stored only if its exact string appears in the archived copy of the report we credit. That is a database constraint, not a review step. Methodology.

  • You can take the whole thing

    CSV, JSON and plain host lists, CC BY 4.0, no key and no account. Export URLs are versioned, so anything you parse keeps its shape. Data and exports.