The instruction is part of the payload
Proofpoint's June 2024 research described campaigns that persuaded users to copy and run PowerShell as a supposed fix for a document or website problem. Its later account documented broader use of the technique known as ClickFix, including fake verification prompts and delivery through several kinds of content.
The clipboard is the handoff: the page supplies command text, and the user is persuaded to execute it. The important transition is from reading a web page or message to executing an instruction on the device. A lure can avoid a conventional executable attachment while still achieving code execution if it persuades the user to supply that final step.
That makes “do not open unknown attachments” an incomplete explanation of this attack class. The suspicious object can be a troubleshooting procedure, a copied command or a request to open a system dialogue. Its apparent helpfulness is part of the mechanism.
A support request worth escalating
An instruction to open a terminal, paste a command or change system configuration should be assessed independently of the page displaying it. Ask which trusted support process requested the action and whether the command can be reviewed through that process.
The presence of a recognisable logo, HTTPS or a realistic error message does not establish that relationship. A compromised legitimate site can also present attacker-controlled instructions. Security training is more useful when it explains this boundary than when it asks users to memorise the appearance of a particular fake CAPTCHA.
For an organisation, provide a short escalation route for suspicious repair instructions. If the legitimate help desk routinely asks people to run opaque copied commands, it becomes harder for those people to distinguish that workflow from an attack. Improving the support process is part of the defensive work.
Preserve the instruction as evidence, without executing it
Record the relevant page or message, the time, the displayed instructions and whether the user actually performed them. Treat any copied command as untrusted text. Do not paste it into a terminal to see what it does, and do not reproduce an active payload in a shared ticket where another person may execute it accidentally.
Where endpoint telemetry is available, correlate the reported action with process creation, command-line records, downloads and subsequent activity. The absence of a conventional attachment event is not surprising for this mechanism.
The distinction between seeing the lure and executing it should remain explicit in the incident record. A visited page may justify triage; confirmed execution changes the assessment of the device and the credentials available on it.
Contain the device and follow its authority
If untrusted code ran, use the organisation's endpoint-response procedure. Establish the device state and preserve the necessary evidence before rebuilding or returning it to ordinary use. Consider the accounts, sessions and developer or cloud credentials that were plausibly accessible there.
That review connects this social-engineering technique to the Snowflake customer-account campaign: an infostealer infection can leave usable credentials long after the local infection is removed. It also connects to session theft, where a password reset does not describe the entire recovery process.
These comparisons identify recovery dependencies. They do not mean that every ClickFix execution produced an infostealer or that every exposed credential was subsequently used. The local investigation still has to establish the payload and consequences.
A tabletop built around the user's actual decision
Read logging coverage before interpreting a missing event
On a Windows PowerShell 5.1 environment where operational logging was already available, an authorised responder can request recent script-block events without executing the recorded content:
Get-WinEvent -FilterHashtable @{
LogName = 'Microsoft-Windows-PowerShell/Operational'
Id = 4104
StartTime = (Get-Date).AddHours(-2)
} -MaxEvents 20 |
Select-Object TimeCreated, Id
This example intentionally omits the event message. Script content can contain sensitive data or a still-dangerous payload; examine it only in the appropriate evidence workflow. The command depends on existing logging, platform support and permissions. It does not enable logging retroactively.
No returned event is not an unaffected finding. Logging may not have been configured, records may have expired, the execution path may differ, or the chosen interval may be wrong. Correlate the user's account of the action with the endpoint platform's available telemetry and its collection limits.
Give the help desk a short evidence handover
The initial handover needs the user and device identity, approximate time, origin of the prompt, requested action and whether it was completed. Record uncertainty explicitly when the user is unsure whether a terminal opened or a command ran.
The help desk should not ask the person to repeat the suspicious procedure for a clearer screenshot. An inert capture of the displayed instruction and a description of what happened are safer starting evidence. Endpoint responders can decide whether additional collection or isolation is appropriate.
This approach also avoids turning the first conversation into a blame exercise. Accurate reporting of the execution boundary is more useful than a user choosing the answer they think the security team wants to hear.
Use an inert example containing no executable command. Present a plausible page claiming that a document requires a local repair. Ask participants where they would verify the instruction and how the help desk would receive the report.
Then move the scenario forward: the user says the command was already run. Can the help desk capture the right facts, involve endpoint responders and identify which account-recovery work may be needed? A useful exercise tests the handover, not only whether a person says the prompt looks suspicious.
The design goal is to make the safe action straightforward: stop at the execution boundary, verify through an established route and report what happened accurately. An interface can be convincing enough that visual polish is a poor security signal. The requested action is the better place to focus attention.