ClickFix Attack: The Simple Mistake That Could Put Your Computer at Risk

There’s a new kind of attack going around, and it’s gotten popular enough that even hackers backed by governments in places like Russia, Iran, and North Korea have started messing around with it. But don’t panic — for most of us, the bigger threat is actually regular cybercriminals who want to steal your passwords, your money, or worse.

The good news? This scam is pretty simple once you know what to look for. It’s called "ClickFix," and it’s really just a fancy way of tricking you into doing the hacker’s dirty work yourself.

Here’s how it works: you might get a fake error message that looks legit, or maybe a pop-up telling you to "register" your PC or "unlock" a secure document. Whatever the story, the goal is always the same — they want you to copy some weird text, open something called PowerShell (basically a command box for your computer), paste the text in, and hit Enter. And just like that, you’ve unknowingly let the bad guys into your system.

Do not under any circumstances do this

​When you do this, you’re actually running a hidden command that downloads malware onto your computer. That malware could do anything from stealing your saved passwords to spying on you or even taking over your whole PC. Some of the nasty programs being used include Lumma Stealer and DarkGate — basically, very bad news.

Early on, these scams mostly used fake "error" messages to scare people into clicking. Now they’re getting sneakier, pretending they’re helping you open a document or access a secured website. But at the end of the day, it’s the same attack every time. Once you recognize the pattern, you’re a lot harder to fool.

If you’re wondering whether this is something only government hackers use, the answer is no. While government-backed groups have tested ClickFix, they mostly moved back to their usual methods after playing around with it. Regular cybercriminals are the ones who are really running with this scam, aiming at everyday people like you and me.

The big red flag you need to remember is this: if anything — an error message, a registration prompt, a document login — tells you to copy some text, open PowerShell, paste it, and hit enter, it’s a scam. Full stop. Just close the window, shut down the app, or back out of whatever website you’re on. Reboot your computer if you want to be extra safe.

Once the malware is active, it can quietly steal your personal information and send it back to the hackers without you even realizing it. Some of it even hides its tracks by clearing out your clipboard or running in a way that’s harder to notice. It's sneaky by design, and it’s counting on you not paying attention.

What I'm saying is never, ever paste anything into PowerShell unless you personally know what it is and why you’re doing it. If a website, app, or random pop-up tries to get you to do it, it’s a scam — plain and simple.

Stay safe out there!