Glossary

The terminology, defined

The same behaviour has four names depending on who wrote the report; these are the definitions this site uses.

ClickFix

A social-engineering technique in which a web page persuades a visitor to run a command on their own machine, usually by pasting it into the Windows Run dialog or the macOS Terminal. Nothing is downloaded that a gateway can inspect, and the process that runs is one the user launched. Also written paste-and-run. The full explanation.

FakeCAPTCHA

The most common ClickFix pretext: a page imitating a human-verification widget that claims the check needs one manual step from you. There is no verification happening; the step is the attack. A real check never asks you to press keyboard shortcuts, open a terminal, or paste anything outside the browser.

ClearFake

A malicious JavaScript framework injected into compromised websites, first documented in 2023. Early versions showed fake browser-update prompts; later ones adopted ClickFix instruction pages, and some moved logic into blockchain smart contracts to resist takedown. The name refers to the framework, not to one operator — several unrelated groups have used it.

FileFix

A variant described in 2025 that swaps the Run dialog for a control that feels more ordinary — the Windows file manager’s address bar, or a file upload dialog — with the same outcome. It exists because people have been told to be suspicious of the Run dialog, and a file path field has not yet acquired that reputation.

Lure page

The web page carrying the instructions. It may sit on a domain the attacker registered, be injected into a hacked legitimate site, or be served through an advertising network. This site describes lure pages and never reproduces them — no markup, no screenshots, not even as an inert example, because a convincing picture of a fake verification prompt is working social engineering.

Indicator of compromise (IoC)

An observable associated with malicious activity — a domain, an IP address, a URL, a file hash — that defenders search their own logs for. An indicator is evidence, not a verdict: the same domain can be attacker-registered in one campaign and a hacked victim in another, and one live in March may be a parked page by August. Every entry here carries the date it was observed for that reason.

Defanging

Writing a hostile value so software will not turn it into a clickable link or fetch it automatically: brackets around the dot in a hostname, and hxxp rather than http. It protects against the accidental click, the chat client that previews a link, and the security tool that fetches every URL it sees. Every indicator here is displayed defanged and never rendered as a link. The defanging tool runs entirely in your browser.

Win+R and the Run dialog

Win+R opens a small box that executes whatever is entered into it with your account’s privileges. ClickFix instructions almost always start here: it exists on every Windows installation, needs no administrator rights, and most people have no intuition about what is normal in it. It is also the best forensic artefact available to a non-specialist, because Windows keeps a list of recent entries — how to read it.

mshta

mshta.exe is a Windows program that runs HTML Application files, including ones fetched from a remote address. It ships with Windows and is signed by Microsoft, so a process list showing it looks unremarkable — one of several built-in tools that turn a pasted line into a running payload. This site records which mechanism a campaign used, never the syntax.

Infostealer

Malware that collects credentials and session data and sends them somewhere: browser passwords, cookies, wallet files, messaging tokens. It is the dominant ClickFix payload and typically finishes in under a minute. The session tokens matter more than the passwords — a stolen session is replayable without a password and without a second factor until it is invalidated, which is why the advice is to sign out everywhere, not only to change passwords.

Command and control (C2)

The infrastructure a payload contacts once running, to receive instructions and send stolen data out. C2 addresses are among the most useful indicators a report can contain, because they outlive the lure domains: the pages carrying the instructions are cheap and disposable, the infrastructure behind them is not.

Dropper

A small first stage whose only job is to retrieve and run the real payload. In a ClickFix chain the pasted line usually acts as the dropper. Because first stages are short and frequently regenerated, their file hashes age badly: a hash from a six-month-old report is a historical record, not a detection you should expect to fire.

TTP

Tactics, techniques and procedures — the durable description of how an operation behaves, as opposed to the disposable specifics it is using this week. ClickFix is a technique; the pretext, the payload and the domains are procedure. That is why this site records execution mechanisms and lure themes alongside indicators: indicators expire, the shape of the attack does not.

ATT&CK T1204.004

The identifier in MITRE ATT&CK for Malicious Copy and Paste, a sub-technique of User Execution (T1204). A shared identifier matters more than it sounds: it lets a detection rule, a vendor report and a control framework refer to the same behaviour without first agreeing on a marketing name for it.

Compromised vs attacker-controlled

Attacker-controlled means the operator registered the domain or stood the server up for this activity. Compromised legitimate means a real site with a real owner is serving attacker content without consent. The second group are victims: they are labelled as such, they never enter the blocklist export, and treating the two identically is the most common way a public indicator list harms people who did nothing wrong. The full taxonomy.

Active, dormant, archived

The three states a campaign record carries. Each is what the reporting we hold supported when the record was last assessed, not a check on what is running today: active — described as ongoing; dormant — no longer described as ongoing; archived — kept as a record and no longer maintained. Nothing here re-checks a campaign after publication, so read the state alongside the first-seen and last-seen dates on the record itself; some records carry neither date.