Social Engineering Attacks Rise as Push Security Takes On ClickFix Threats

by

Estimated reading time: 3 minutes

An employee might find their browser frozen while doing everyday work. A CAPTCHA-style prompt, which is meant to tell humans from bots, appears and says the page failed to load, asking for quick action. The screen tells the user to copy a short command to fix the problem. That one step can put the system at risk. This example shows the real dangers behind new social engineering attacks and leads to the next question: What is a ClickFix-style threat?

What Is a ClickFix-Style Social Engineering Attack
Illustration of a fake CAPTCHA on a desktop monitor with a devil-like cyberattack figure emerging from flames, representing ClickFix social engineering attacks.

ClickFix-style attacks trick users instead of sending malware links. Attackers use fake CAPTCHA pages, verification prompts, or error messages. These fake security tests are designed to make users think the site is real. They tell users to copy and paste a script into their system. When run, the script can install malware, steal usernames and passwords, or take over web browsing. The attack works because the request seems normal and trustworthy.

Why ClickFix Attacks Are Spreading Quickly

Security researchers have seen ClickFix attacks rise by 400% to 517% in the past year. Victims include financial services, healthcare, retail, and government organizations. Ransomware groups are using this method more often because it gets around standard phishing defenses by not using links or attachments.

How Push Security Stops ClickFix at the Source

Push Security has added a browser feature to block ClickFix attacks. It spots and stops harmful copy-and-paste actions as they happen, preventing malware from running on the device.

The system watches for copy actions in the browser. It can tell the difference between safe actions, like copying code from trusted tools, and harmful scripts. This approach gives accurate alerts and reduces false alarms.

Push Security logo

“ClickFix is now one of the most effective techniques attackers use to steal business data,” said Jacques Louw, chief product officer at Push Security. “Email and endpoint tools often miss it during delivery or execution. We stop these attacks where they begin, in the browser.”

See also  When Cyber Insurance Lets You Down, 831(b) Offers A Plan B - NEW PODCAST

Get The Cyber Insuance News Upload Delivered
Subscribe to our newsletter!

New Variants Raise the Stakes

Push researchers have also found a new version called ConsentFix. This method can take over accounts just by using copy-and-paste. If the user is already logged in, there are no requests for passwords or multi-factor authentication. This approach gets around even strong anti-phishing protections. Security teams need strong browser-level detection because this attack uses steps that are hard to avoid. Improving detection will help stop social engineering from being a common attack method. Make sure to focus on better detection strategies to fight this new threat.

Martin Hinton

Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.


×