ClickFix Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 24, 2026 | License: CC BY 4.0
Microsoft saw ClickFix-style pasted commands run on more than 1.1 million unique devices between February and early May 2026, climbing from 38,000 to 310,000 devices a week. On October 20, 2026, Google added a ClickFix copy warning to Chrome, for Enhanced Protection users only: 31 months after the first documented campaign, Axis Intelligence Research calculates.
Quick Answer
ClickFix is a social engineering attack in which a fake CAPTCHA, error message or “verification” page tells the victim to copy a command and paste it into the Windows Run dialog, PowerShell or the macOS Terminal. The victim runs the malware themselves, which is why MITRE ATT&CK catalogs it as T1204.004, User Execution: Malicious Copy and Paste.
The 2026 numbers point in two directions at once. Lure detections collapsed: ESET’s ClickFix detections in the first half of 2026 were at most 7.8% of their mid-2025 peak, by Axis calculation. Executions did not: Microsoft’s Digital Defense Report 2026 counts more than 1.1 million devices that ran ClickFix-style commands in roughly three months and says ClickFix grew roughly 23x between December 2025 and May 2026. Both vendors saw the same late-2025 trough; they disagree on the size of the rebound. The attack moved away from the fake-CAPTCHA signature security products learned to catch, and toward the one step no signature sees: a human pasting a command.
Browsers and operating systems answered late. Axis Intelligence Research’s Native Paste Defense Lag (NPDL), the number of months between the first documented ClickFix campaign (March 2024) and a vendor’s first built-in paste or copy warning, stands at 24 months for macOS, 28 for Opera, 31 for Chrome and at least 31 for Windows, which had no native Run-dialog warning as of October 24, 2026.
Key Findings
- Axis Intelligence Research calculates a Native Paste Defense Lag (NPDL) of 31 months for Google Chrome: the first ClickFix campaign was documented in March 2024 and Chrome’s Enhanced Protection copy warning was announced on October 20, 2026.
- Axis Intelligence Research estimates that ESET’s ClickFix detections in H1 2026 were at most 7.8% of the H1 2025 peak (≤124,800 vs >1.6 million), even after a 108% rebound.
- Axis Intelligence Research calculates that the number of devices running ClickFix commands each week doubled roughly every 4.3 weeks in spring 2026, from 38,000 in the first week of February to 310,000 in the first week of May, based on Microsoft Defender telemetry.
- Axis Intelligence Research estimates that ClickFix detections in Japan, ESET’s most affected country, fell by more than 95% between H1 2025 (≥368,000) and H1 2026 (≤17,472), while Japan stayed the top country by share.
- Axis Intelligence Research finds that Chrome is the only one of the three native ClickFix defenses shipped in 2026 that is opt-in: macOS Terminal blocks pastes at system level and Opera’s Paste Protect is on by default, while Chrome’s warning covers Enhanced Protection users only.
ClickFix Statistics at a Glance
| Metric | Value | Period | Source |
|---|---|---|---|
| Devices that ran ClickFix-style commands | >1.1 million (≈8x increase) | Feb–early May 2026 | Microsoft MDDR 2026 |
| Devices per week running a ClickFix command | 38,000 → 310,000 | Feb W1 → May W1 2026 | Microsoft MDDR 2026, p. 45 |
| ClickFix growth, December to May | ≈23x | Dec 2025–May 2026 | Microsoft MDDR 2026, p. 44 |
| ClickFix intrusions followed by malware | 96.3% | Jul 2025–Jun 2026 | Microsoft MDDR 2026, p. 44 |
| Malicious copy and paste, share of observed intrusions | 12.8% (vs 47% a year earlier) | Jul 2025–Jun 2026 | Microsoft MDDR 2026, p. 44 |
| User execution share of observed initial access | 30% | Jul 2025–Jun 2026 | Microsoft MDDR 2026 |
| ClickFix share of initial access notifications (rank #1) | 47% | MDDR 2025 year | Microsoft MDDR 2025 |
| HTML/FakeCaptcha detection growth | +517% | H2 2024 → H1 2025 | ESET H1 2025 |
| ESET ClickFix detections | >1.6M → <60,000 | H1 2025 → H2 2025 | ESET H2 2025 |
| ESET ClickFix detection rebound | +108% | H2 2025 → H1 2026 | ESET H1 2026 |
| ClickFix share of malware loader activity | 53% | 2025 | Huntress |
| ClickFix URL malware campaigns, YoY | nearly +400% | 2025 report | Proofpoint |
| CAPTCHA-gated phishing attacks detected | >100 million | Jul 2025–Jun 2026 | Microsoft MDDR 2026, p. 66 |
| ClickFix kit subscription price | US$200–$1,500/month | 2025 | Microsoft Threat Intelligence |
| NPDL: Chrome / Opera / macOS / Windows | 31 / 28 / 24 / ≥31 months | as of Oct 24, 2026 | Axis Intelligence Research (calculated) |
Every number on this page maps to a row in the downloadable CSV, with source organization, document, URL and retrieval date.
How many devices has ClickFix hit in 2026?
Microsoft’s answer is the largest public execution count available: between February and early May 2026, Microsoft Defender observed ClickFix-style attacker-supplied commands executed on more than 1.1 million unique devices, an approximately eightfold increase, according to the Microsoft Digital Defense Report 2026 (published October 1, 2026; reporting period July 2025 to June 2026).
That count measures something different from most ClickFix statistics in circulation. ESET, Proofpoint and email gateways count lures: pages, emails and scripts blocked before anyone acts. Microsoft’s figure counts devices where the command was actually run. It is the closest public measure of ClickFix victims rather than ClickFix attempts.
The full report (p. 45) shows how fast that happened. Microsoft’s weekly series of unique devices running an attacker-supplied ClickFix command, from Microsoft Defender behavioral telemetry:
| Week (Microsoft label) | Devices running a ClickFix command | Change vs previous point |
|---|---|---|
| February, week 1 | 38,000 | — |
| February, week 2 | 52,000 | +37% |
| March, week 1 | 71,000 | +37% |
| March, week 2 | 95,000 | +34% |
| April, week 1 | 130,000 | +37% |
| April, week 2 | 188,000 | +45% |
| April, week 5 | 240,000 | +28% |
| May, week 1 | 310,000 | +29% |
Source: Microsoft Threat Intelligence, Microsoft Digital Defense Report 2026, p. 45. Percent changes calculated by Axis Intelligence Research.
From the first week of February to the first week of May, weekly devices rose 8.2x (310,000 ÷ 38,000), which matches Microsoft’s “~8x” summary. Over those 13 weeks, Axis Intelligence Research calculates an average weekly growth rate of about 17.5%, meaning the number of devices running ClickFix commands doubled roughly every 4.3 weeks. Microsoft attributes the surge to “a proliferation of kits-for-hire,” with ClickFix builders sold as malware-as-a-service. Measured over a longer window, the report says ClickFix “waned in late 2025, then rebounded explosively in early 2026, growing roughly 23x between December and May” (p. 44).
ClickFix’s share of intrusions fell while its volume rose
The same report shows the share of intrusions moving the other way. In the MDDR 2025, ClickFix was the most common initial access method in Defender Experts notifications, at 47%, ahead of phishing (35%), password spray (10%) and drive-by compromise with SEO poisoning (7%) (MDDR 2025, p. 36). In the MDDR 2026, malicious copy and paste accounts for 12.8% of observed intrusions (p. 44), with Microsoft describing “a more diversified threat landscape.”
| Initial access technique (Defender Experts notifications) | MDDR 2025 | MDDR 2026 |
|---|---|---|
| ClickFix / malicious copy and paste | 47% | 12.8% (shown as 13) |
| User execution (fake updates, AI lures, other) | not reported separately | 30% |
| Valid accounts | not reported separately | 20% |
| Phishing | 35% | 10.9% (shown as 11) |
| Password spray | 10% | included in valid accounts |
| Drive-by compromise | 7% (incl. SEO poisoning) | 6% |
| Vulnerability / exploitation of public-facing application | 1% | 4.8% (shown as 5) |
| Other | — | 1% |
Sources: MDDR 2025, p. 36; MDDR 2026, p. 44. The two years use different category sets, so the table compares like-named rows only.
Axis Intelligence Research reads the 34.2-point drop in share (47% → 12.8%) next to the eightfold rise in weekly executions as a change in mix, not a retreat: ClickFix volume grew while other entry points grew faster, and Microsoft now reports a separate user execution category (30%) that covers fake browser updates, AI-generated lures and multi-stage payloads. Microsoft also reports that the follow-on after a ClickFix execution “is almost uniformly malware (96.3%),” which it calls “one of the most conversion-efficient initial access techniques observed.”
Two other vendors confirm the scale from their own telemetry. Huntress, drawing on more than 4 million endpoints across 230,000+ organizations, attributes 53% of 2025 malware loader activity to ClickFix. In its own SOC, Huntress reports that ClickFix-style Run dialog attacks account for 31% of EDR signals. Both are company-reported figures; the second appears in a post promoting a Huntress product.
Marcus Chen, co-author: The 1.1 million figure deserves more weight than the percentages because it comes from execution telemetry, not from a filter. A blocked email tells you an attacker tried. A device that ran an attacker’s PowerShell tells you the defense stack ahead of the user, the email gateway, the web filter, the browser download check, all let the lure through. ClickFix is engineered for that gap: there is no file download for the browser to inspect, and the process that runs the command is a signed Windows binary.
Is ClickFix going up or down? ESET detection statistics 2024–2026
Lure detections peaked in the first half of 2025 and have not returned. ESET, which tracks ClickFix under the detection name HTML/FakeCaptcha, reported growth of 517% from H2 2024 to H1 2025, when ClickFix reached nearly 8% of all attacks ESET blocked and ranked second in its malware top 10 at 7.7% of detections (ESET Threat Report H1 2025). ESET described the threat as “virtually nonexistent” a year earlier.
Then the series broke. ESET’s H2 2025 report counts more than 1.6 million HTML/FakeCaptcha detections in H1 2025 and fewer than 60,000 in H2 2025, following the May 2025 disruption of Lumma Stealer, ClickFix’s main payload; Lumma detections fell 86% over the same period. The H1 2026 report records a 108% rebound, with ESET noting that levels remain below the 2025 boom.
ClickFix Lure Detection Index, rebased (H2 2024 = 100)
ESET publishes a mix of growth rates and rounded counts. Axis Intelligence Research converted them into a single series so the four half-years can be compared directly.
| ESET half-year | Months covered | Detections | Index (H2 2024 = 100) | Inputs |
|---|---|---|---|---|
| H2 2024 | Jun–Nov 2024 | ≥259,319 (implied) | 100 | 1,600,000 ÷ (1 + 5.17) |
| H1 2025 | Dec 2024–May 2025 | >1,600,000 | 617 | 100 × 6.17 |
| H2 2025 | Jun–Nov 2025 | <60,000 | ≤23.1 | 617 × (60,000 ÷ 1,600,000) |
| H1 2026 | Dec 2025–May 2026 | ≤124,800 (implied) | ≤48.1 | 60,000 × 2.08 |
Source data: ESET H1 2025, ESET H2 2025, ESET H1 2026. Index and implied counts calculated by Axis Intelligence Research.
On that basis, Axis Intelligence Research calculates a decline of at least 96.3% from H1 2025 to H2 2025 (1 − 60,000 ÷ 1,600,000) and estimates that H1 2026 detections were at most 7.8% of the peak (124,800 ÷ 1,600,000). Even after doubling, ClickFix lure detections in early 2026 sat below half their H2 2024 level.
Why lure detections fell while executions rose
The two curves are not contradictory once you separate what each one counts. Three factors explain the divergence, all documented in the vendors’ own reports:
- The payload changed. ESET’s 2025 spike was driven by Lumma Stealer campaigns. When Lumma’s infrastructure was disrupted in May 2025, the campaigns that carried the HTML/FakeCaptcha signature collapsed with it, but the technique did not. ESET’s H2 2025 report states ClickFix remained in use.
- The lure changed. ESET’s H1 2026 report says real prevalence is higher than its ClickFix count because newer variants are detected under other names. The fake CAPTCHA has been joined by fake crash screens, fake Windows blue screens, WordPress admin prompts, macOS-specific lures and AI-generated “fix” pages (see variants below).
- The counter changed. Microsoft counts executed commands on endpoints. A lure that evades a page-level signature still shows up in Microsoft’s count once someone runs it.
The two vendors agree on the shape, if not the size. Microsoft’s own report says ClickFix “waned in late 2025” before growing roughly 23x between December 2025 and May 2026 (MDDR 2026, p. 44); ESET measured the same trough and a 108% rebound over December 2025 to May 2026. A 23x rebound in executions against a 2.08x rebound in lure detections is the clearest public evidence that most 2026 ClickFix activity no longer matches the 2025 detection signature.
Marcus Chen, co-author: Read the ESET series as a measure of how well one detection name tracks one family of pages, not as a measure of risk. The drop after May 2025 is real and it is a law enforcement result, but it should not be quoted as “ClickFix is fading.” Microsoft’s execution count rose over the same period that ESET’s lure count stayed low. When those two diverge, the attacker has moved somewhere your signatures are not.
Email-delivered ClickFix shows the same growth trend from a third vantage point. Proofpoint reports that ClickFix URL-based malware campaigns grew by nearly 400% year over year in its 2025 Human Factor research, and that about 34% of URL-based malware campaigns delivered remote access software.
Which countries are most targeted by ClickFix?
Japan has led ESET’s ClickFix telemetry in both half-years for which ESET published country shares. In H1 2025, Japan accounted for 23% of ESET’s HTML/FakeCaptcha detections, followed by Peru (6%) and Poland, Spain and Slovakia (each above 5%). In H1 2026, Japan’s share fell to 14%, ahead of Slovakia (7%) and France, Spain and Peru (each above 5%).
| Country | H1 2025 share | H1 2026 share | Source |
|---|---|---|---|
| Japan | 23% | 14% | ESET H1 2025, ESET H1 2026 |
| Slovakia | >5% | 7% | ESET H1 2025, H1 2026 |
| Peru | 6% | >5% | ESET H1 2025, H1 2026 |
| Spain | >5% | >5% | ESET H1 2025, H1 2026 |
| Poland | >5% | not in top list | ESET H1 2025 |
| France | not in top list | >5% | ESET H1 2026 |
Shares hide the volume change. Applying each share to ESET’s half-year total, Axis Intelligence Research estimates that Japan saw at least 368,000 ClickFix detections in H1 2025 (1,600,000 × 23%) and at most 17,472 in H1 2026 (124,800 × 14%), a decline of more than 95%. Japan remained the most targeted country while its absolute count fell to roughly one-twentieth of the peak.
Government advisories show where ClickFix is operating outside ESET’s sample. Australia’s ASD’s ACSC warned on May 7, 2026 of ClickFix campaigns running on compromised Australian WordPress sites to deliver Vidar Stealer, with activity against Australian networks since early 2026.
Marcus Chen, co-author: Japan’s position at the top of the list, with Slovakia and Peru close behind, is more likely a product of which campaigns ESET’s customer base encountered than of any national weakness. Country rankings from a single vendor reflect that vendor’s install base. The useful reading is the volume: the country most exposed in 2025 saw the steepest absolute fall once Lumma went down.
How does Chrome’s new ClickFix warning work, and who gets it?
Google’s October 20, 2026 announcement describes the mechanism. When a Chrome user with Safe Browsing Enhanced Protection copies a suspicious command from a web page, Chrome strips the payload of personal information and sends it to Safe Browsing for a verdict. If the verdict is dangerous, Chrome shows a warning. Google says the classifier runs with “high precision” and is backed by a server-side Gemini model.
Google gives the reason it intervenes at copy time: ClickFix commands usually call living-off-the-land binaries such as PowerShell or cmd.exe, so they sidestep Chrome’s download protections entirely. There is no file to scan.
| Chrome Enhanced Protection fact | Value | Source |
|---|---|---|
| ClickFix copy warning announced | October 20, 2026 | |
| Protection tier required | Enhanced Protection (opt-in) | |
| Chrome users with Enhanced Protection | >1 billion (as of Feb 11, 2025) | |
| Enhanced vs Standard Protection safety | “ten times safer” (by average warnings shown) | |
| Enhanced Protection launched | 2020 |
The coverage question is the practical one. Enhanced Protection is a setting the user turns on; Chrome’s default is Standard Protection, and Google’s own post asks readers to enable Enhanced Protection. Google’s most recent public figure is more than 1 billion Enhanced Protection users, from February 2025. For context on how many people that leaves on Standard Protection, see Axis’s Chrome statistics and browser market share data.
Marcus Chen, co-author: Copy-time inspection is the right place to intervene, because it is the last point where the browser can see the command before it leaves for a shell the browser does not control. The design choice that matters is the opt-in. The users most likely to follow a “press Win+R and paste” instruction are the users least likely to have changed a security setting. Enterprise admins can enforce Enhanced Protection through Chrome policy, and for managed fleets that is now worth doing for this reason alone.
How long did browsers and operating systems take to block ClickFix?
Axis Intelligence Research’s Native Paste Defense Lag (NPDL) measures the months between the first documented ClickFix campaign and a vendor’s first built-in, user-facing warning against pasting or copying malicious commands. The start point is March 2024, when ClickFix emerged in a campaign documented by Proofpoint, according to ESET; Microsoft dates its first observations to March–June 2024.
NPDL = (year of native defense − 2024) × 12 + (month of native defense − 3)
| Platform | Native defense | Date | NPDL (months) | Default coverage | Source |
|---|---|---|---|---|---|
| MITRE ATT&CK (reference) | T1204.004 technique created | Mar 18, 2025 | 12 | n/a (taxonomy) | MITRE |
| macOS | Terminal “Possible malware, Paste blocked” warning (Tahoe 26.4) | Mar 2026 | 24 | System-level, Terminal only | Reported by Malwarebytes, Mar 30, 2026 |
| Opera | Paste Protect | Jul 2, 2026 | 28 | On by default (desktop) | Opera |
| Chrome | Copy-command warning | Oct 20, 2026 | 31 | Enhanced Protection only (opt-in) | |
| Windows | No native Run-dialog paste warning located | — | ≥31 (open) | Admin controls only | Microsoft guidance |
Opera’s press release calls Paste Protect “the first native defense against clipboard-based attacks in a major browser,” a company claim. It blocks the copy, shows the first 120 characters of the command, and applies rules for Windows, macOS and Linux commands. The macOS Terminal warning was reported by Malwarebytes in March 2026; Axis did not locate Apple documentation for the feature as of October 24, 2026.
Windows remains the open case. Microsoft’s ClickFix guidance relies on controls administrators deploy: disabling the Run dialog by Group Policy, Windows Terminal’s multi-line paste warning, App Control and PowerShell logging. None of these is a default warning for a home user pressing Win+R.
Marcus Chen, co-author: NPDL is a deliberately simple number because the point is simple: it took the security community 12 months to name this technique and the platforms another 12 to 19 months to put a warning in front of users. The most exposed surface, the Windows Run dialog, still has none by default. Expect NPDL to become a fair way to judge how quickly vendors respond to the next user-execution technique, because ClickFix will not be the last attack that relies on the victim doing the final step.
What does ClickFix install? Payloads, loaders and kit prices
ClickFix is a delivery method, not a malware family. Microsoft Threat Intelligence names Lumma Stealer as the most prolific payload, alongside remote access trojans (Xworm, AsyncRAT, NetSupport, SectopRAT), loaders (Latrodectus, MintsLoader) and the r77 rootkit. On macOS, Microsoft documented an Atomic macOS Stealer (AMOS) campaign impersonating Spectrum in late May 2025. ESET’s H1 2025 report adds that the Interlock ransomware group used ClickFix for initial access; see Axis’s ransomware attack cost data for what that step leads to.
| Item | Detail | Source |
|---|---|---|
| Most prolific payload | Lumma Stealer | Microsoft, ESET |
| ClickFix kit subscription | US$200–$1,500 per month | Microsoft |
| Kit components sold separately | US$200–$500 | Microsoft |
| Kits advertised since | Late 2024 | Microsoft |
| Windows Run dialog input limit | 259 characters | Microsoft |
| URL malware campaigns delivering remote access software | ≈34% | Proofpoint |
Microsoft’s 2026 data shows what follows a user-execution intrusion of any kind: malware in 60.3% of cases, infostealers in 12.3% and credential theft in 9.4%, with PowerShell and cmd.exe as the primary execution vehicles (MDDR 2026, p. 44). For ClickFix specifically the follow-on is malware in 96.3% of cases. The report also flags a shift toward legitimate remote monitoring and management (RMM) tools: in ClickFix-themed campaigns, the pasted command often calls PowerShell to fetch and silently install an RMM client, which then looks like normal IT traffic (p. 69).
The 259-character limit shapes the attack: a ClickFix command is a short stager that downloads and runs the real payload, typically through PowerShell or mshta. Microsoft notes that early in 2025 it saw thousands of enterprise and consumer devices affected each month, including devices running endpoint detection and response.
The procedure examples MITRE lists under T1204.004 show who uses it beyond commodity crime: Kimsuky and MuddyWater sit next to Contagious Interview, Havoc, Kali365 and Vidar. ESET’s H1 2025 report names further state-aligned users, including Lazarus, Callisto, Sednit and APT36.
Marcus Chen, co-author: A US$200 monthly kit puts ClickFix in the same price band as mainstream phishing-as-a-service, and it removes the most expensive step of a malware campaign: getting code past the endpoint. The victim does that part for free. Pricing at this level is why the technique outlived Lumma, and why the next takedown is unlikely to end it either.
How do ClickFix lures reach victims?
ClickFix pages arrive through three main routes: phishing email, compromised legitimate websites and malicious ads. A related pattern, CAPTCHA-gated phishing, uses a fake CAPTCHA to hide credential-phishing pages from scanners. It is not ClickFix (no command is pasted), but it trains users to trust “verify you are human” screens, and it shares infrastructure with ClickFix lures.
Microsoft’s Q1 2026 email threat report counts 8.3 billion email phishing threats in the quarter. CAPTCHA-gated phishing fell 45% in January and 8% in February, then rose 125% in March to 11.9 million, its highest level in a year. Axis Intelligence Research back-calculated the monthly volumes:
| Month | CAPTCHA-gated phishing emails | Change | Basis |
|---|---|---|---|
| Dec 2025 | ≈10.45 million (implied) | — | 5.75M ÷ (1 − 0.45) |
| Jan 2026 | ≈5.75 million (implied) | −45% | 5.29M ÷ (1 − 0.08) |
| Feb 2026 | ≈5.29 million (implied) | −8% | 11.9M ÷ (1 + 1.25) |
| Mar 2026 | 11.9 million | +125% | Reported by Microsoft |
| Q1 2026 total | ≈22.94 million (implied) | Sum of Jan–Mar |
Across Microsoft’s full reporting year, CAPTCHA-gated phishing passed 100 million attacks between July 2025 and June 2026 (MDDR 2026, p. 66). The hosting picture shifted at the same time: the Tycoon2FA phishing-as-a-service platform drove 9% of CAPTCHA-gated phishing in July 2025 and 76% by December, then fell to 12% by June 2026 after Microsoft, Europol and partners disrupted it (MDDR 2026, pp. 66 and 68). Microsoft’s Q1 email report puts Tycoon2FA’s share of CAPTCHA-gated sites at 41% in March 2026, midway through that decline. Delivery formats rotated just as fast, from embedded URLs (58% in August 2025) to SVG files (47% in November) to PDFs (nearly two-thirds by April 2026). For the wider phishing picture, see Axis’s phishing statistics and AI phishing statistics.
On the web side, CTM360’s ClickFix research draws on more than 3,000 compromised websites, and ASD’s ACSC traced its 2026 Vidar campaign to hijacked WordPress sites. The visitor sees a familiar site and an unfamiliar “verification” step, which is why users reasonably trust it.
ClickFix variants in 2026: CrashFix, ConsentFix, FileFix and AI-fix
ESET’s H1 2026 Threat Report and Microsoft’s Digital Defense Report 2026 document the variants that explain why a single detection name now undercounts the technique:
| Variant | How it works | Target | Source |
|---|---|---|---|
| CrashFix | Fake ad blocker extension (NexShield) waits 60 minutes, crashes the browser, then shows a “fix” with a paste-and-run command | Windows browser users | ESET H1 2026 |
| ConsentFix | Victim is tricked into copying and pasting an OAuth authorization code, handing over a Microsoft account session with no MFA prompt | Microsoft accounts | ESET H1 2026 |
| AI-fix | Malicious instructions hosted on legitimate AI content-sharing pages (Anthropic Artifact pages, OpenAI Canvas, Microsoft Copilot Pages) | Users searching for fixes | ESET H1 2026 |
| FileFix | Victim pastes the command into the Windows File Explorer address bar instead of Run or Terminal, bypassing controls that watch only PowerShell and Run | Windows users | MDDR 2026, p. 45 |
| TikTok AI ClickFix | AI-generated “activation” tutorial videos with synthetic narration end in a malicious command fetching Vidar or StealC; some videos topped ~500,000 views | Consumers searching for free software | MDDR 2026, p. 15 |
| macOS lures | Terminal commands delivering infostealers | Mac users | ESET H1 2026, Microsoft |
| Fake BSOD / WordPress prompts | Fake Windows crash screens and fake WordPress admin warnings | Windows users, site admins | ESET H1 2026 |
ConsentFix matters for identity teams because it does not execute code at all. The paste step hands over an authorization code, so endpoint telemetry never sees it. Axis’s credential attack statistics cover the session-theft side of that problem.
Marcus Chen, co-author: The variants share one trait: each moves the paste target to somewhere the existing defenses were not watching. CrashFix delays the lure by an hour so it no longer looks connected to the extension install. ConsentFix pastes into a browser address bar instead of a shell. AI-fix borrows the reputation of a trusted domain. FileFix swaps the shell for File Explorer. A Chrome warning that inspects copied commands can act on any variant that relies on copying a command from a web page, including FileFix; it is a weaker fit for ConsentFix, where the pasted item is an authorization code, not a command.
How to stop ClickFix: what the data says works
The most direct control is removing the paste target. Microsoft’s ClickFix guidance recommends disabling the Run dialog through Group Policy where users do not need it, and Huntress reports that in its Early Access organizations, more than 90% of users commonly never use the Run dialog at all (company-reported, from a product announcement).
| Control | Addresses | Evidence | Source |
|---|---|---|---|
| Disable Win+R Run dialog by Group Policy | Windows Run-dialog ClickFix | 31% of Huntress EDR SOC signals are Run dialog attacks; 90%+ of users never use it | Microsoft, Huntress |
| Enforce Chrome Enhanced Protection by policy | Copy-time command inspection | Native ClickFix warning available to EP users since Oct 20, 2026 | |
| Windows Terminal multi-line paste warning | Multi-line PowerShell pastes | Microsoft-recommended setting | Microsoft |
| App Control / PowerShell constrained language and logging | Stager execution | Microsoft-recommended | Microsoft, ACSC |
| Block clipboard writes from untrusted JavaScript | Lure-side copy step | Government-recommended mitigation | ACSC |
| Monitor RunMRU registry key | Forensics after execution | Records commands typed into Run | Microsoft |
| Detection strategy DET0340 | Process lineage from browser to shell | MITRE detection mapping | MITRE |
For the human side, Axis’s social engineering statistics and business email compromise statistics put ClickFix next to the other techniques that rely on a convinced user rather than an exploit. The wider malware context, including the infostealer families ClickFix delivers, is in Axis’s malware statistics.
Marcus Chen, co-author: Awareness training should teach one rule, not a list of red flags: no legitimate website, CAPTCHA or support page ever asks you to open Run, PowerShell or Terminal and paste something. That rule survives every variant ESET documented in 2026. Technical controls should assume the rule will be broken, which is why removing the Run dialog for users who never touch it is the cheapest high-yield control on this list.
ClickFix statistics master table
| # | Statistic | Value | Period | Source org |
|---|---|---|---|---|
| 1 | Devices running ClickFix-style commands | >1.1 million | Feb–early May 2026 | Microsoft |
| 2 | Increase over that window | ≈8x | Feb–early May 2026 | Microsoft |
| 3 | User execution share of initial access | 30% | Jul 2025–Jun 2026 | Microsoft |
| 3a | Devices per week running a ClickFix command | 38,000 → 310,000 | Feb W1 → May W1 2026 | Microsoft |
| 3b | ClickFix growth, December to May | ≈23x | Dec 2025–May 2026 | Microsoft |
| 3c | ClickFix intrusions followed by malware | 96.3% | Jul 2025–Jun 2026 | Microsoft |
| 3d | Malicious copy and paste, share of intrusions | 12.8% | Jul 2025–Jun 2026 | Microsoft |
| 3e | CAPTCHA-gated phishing attacks | >100 million | Jul 2025–Jun 2026 | Microsoft |
| 4 | ClickFix share of initial access notifications | 47% | MDDR 2025 year | Microsoft |
| 5 | HTML/FakeCaptcha growth | +517% | H2 2024 → H1 2025 | ESET |
| 6 | Share of all ESET-blocked attacks | nearly 8% | H1 2025 | ESET |
| 7 | ESET detections | >1.6M → <60,000 | H1 → H2 2025 | ESET |
| 8 | Lumma Stealer detections | −86% | H2 2025 | ESET |
| 9 | ClickFix detection rebound | +108% | H2 2025 → H1 2026 | ESET |
| 10 | Japan share of detections | 23% → 14% | H1 2025 → H1 2026 | ESET |
| 11 | ClickFix share of malware loader activity | 53% | 2025 | Huntress |
| 12 | Run dialog attacks, share of EDR SOC signals | 31% | 2026 | Huntress |
| 13 | ClickFix URL malware campaigns, YoY | nearly +400% | 2025 report | Proofpoint |
| 14 | ClickFix kit subscription | US$200–$1,500/month | 2025 | Microsoft |
| 15 | CAPTCHA-gated phishing, March 2026 | 11.9 million (+125%) | Mar 2026 | Microsoft |
| 16 | Chrome Enhanced Protection users | >1 billion | Feb 2025 | |
| 17 | NPDL: Chrome | 31 months | Mar 2024–Oct 2026 | Axis Intelligence Research |
| 18 | NPDL: Opera / macOS | 28 / 24 months | to Jul 2026 / Mar 2026 | Axis Intelligence Research |
| 19 | ESET H1 2026 vs H1 2025 peak | ≤7.8% | H1 2026 | Axis Intelligence Research |
| 20 | Japan detections, H1 2025 → H1 2026 | ≥368,000 → ≤17,472 (>95% decline) | H1 2025 → H1 2026 | Axis Intelligence Research |
| 21 | ESET detections, H1 → H2 2025 | ≥96.3% decline | 2025 | Axis Intelligence Research |
| 22 | Weekly ClickFix executions, doubling time | ≈4.3 weeks | Feb–May 2026 | Axis Intelligence Research |
Methodology
Collection. Axis Intelligence Research retrieved every source on this page directly on October 24, 2026: three ESET Threat Reports (PDF), the full Microsoft Digital Defense Report 2025 (v5, November 21, 2025) and 2026 (v1.1) PDFs, cited by page number, alongside their Security Insider summaries, two Microsoft Security blog posts, two Google blog posts, an Opera press release, the MITRE ATT&CK technique page, an ASD’s ACSC advisory, and vendor publications from Huntress, Proofpoint and CTM360. Figures were recorded with the source’s own qualifier (“more than,” “fewer than,” “nearly”). Every figure in this article appears in the CSV with source organization, document, URL and retrieval date.
Primary-source rule. The body links only to the organization that produced each number. Where a figure is reported only by a third party (the macOS Tahoe 26.4 Terminal warning, reported by Malwarebytes), it is labeled as reported and marked is_primary = false in the CSV. Company-reported figures are labeled as such where the vendor has a commercial interest in the result.
Axis calculations. All calculated values are flagged axis_calculated = true with the formula in method_note:
- Implied H2 2024 ESET detections = 1,600,000 ÷ (1 + 5.17) = 259,319
- Implied H1 2026 ESET detections = 60,000 × (1 + 1.08) = 124,800
- ClickFix Lure Detection Index = half-year detections ÷ H2 2024 detections × 100
- H1 2026 vs peak = 124,800 ÷ 1,600,000 = 7.8%
- Japan implied detections = half-year total × ESET country share
- CAPTCHA-gated phishing back-calculation = March volume ÷ (1 + March change), then repeated for February and January
- Weekly growth and doubling time = (310,000 ÷ 38,000)^(1/13) − 1 = 17.5% per week; doubling time = ln 2 ÷ ln 1.175 = 4.3 weeks
- Native Paste Defense Lag (NPDL) = months from March 2024 to the month a vendor first shipped or announced a native, user-facing paste or copy warning
Where the numbers stop. ESET publishes rounded thresholds (“more than 1.6 million,” “fewer than 60,000”), so Axis-derived values are bounds, shown with ≥ or ≤. The H1 2026 estimate assumes ESET’s 108% growth figure applies to the same detection family as its H2 2025 count; ESET itself says real prevalence is higher because newer variants are detected under other names. Country shares come from one vendor’s customer base. Microsoft’s 1.1 million device count and ESET’s detections measure different events (executions vs blocked lures) and are not added together. CAPTCHA-gated phishing is a related lure pattern, not ClickFix execution. NPDL uses announcement month, not general availability on every device, and the macOS date relies on a third-party report. Microsoft’s weekly series uses Microsoft’s own week labels (including “April W5”); the 4.3-week doubling time assumes about 13 weeks between the first and last points. The MDDR 2025 and 2026 initial access breakdowns use different category sets.
Excluded on purpose. Statistics circulating only through secondary compilations, without a retrievable primary document, were left out, as was ESET’s H2 2025 “37% decline,” which refers to Nomani investment scams rather than ClickFix.
About this dataset
Name: ClickFix Statistics 2026 Dataset
File: clickfix-statistics-2026-dataset.csv (UTF-8, comma-separated, long format, 108 rows, 17 columns)
Creator: Axis Intelligence Research, with Marcus Chen
Coverage: March 2024 to October 24, 2026; global, with country breakdowns for Japan, Slovakia, Peru, Spain, Poland, France and an Australian advisory
Columns: row_id, metric_id, metric, value, qualifier, unit, period_start, period_end, as_of_date, geography, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note
Values: raw numbers (percentages as 47, not 0.47; dates in ISO 8601). The qualifier column carries the source’s wording: exact, more_than, fewer_than, at_least, at_most, nearly, approximately.
License: Creative Commons Attribution 4.0 (CC BY 4.0). Reuse, chart and republish freely with attribution to Axis Intelligence Research and a link to this page.
How to cite this page
APA: Axis Intelligence Research, & Chen, M. (2026, October 24). ClickFix statistics 2026: The copy-paste attack Chrome took 31 months to block. Axis Intelligence. https://axis-intelligence.com/clickfix-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “ClickFix Statistics 2026: The Copy-Paste Attack Chrome Took 31 Months to Block.” Axis Intelligence, 24 Oct. 2026, axis-intelligence.com/clickfix-statistics/.
Chicago: Axis Intelligence Research, and Marcus Chen. “ClickFix Statistics 2026: The Copy-Paste Attack Chrome Took 31 Months to Block.” Axis Intelligence, October 24, 2026. https://axis-intelligence.com/clickfix-statistics/.
Citing the metric: “Native Paste Defense Lag (NPDL), Axis Intelligence Research, October 2026.”
Frequently asked questions
Does Chrome’s ClickFix warning protect Standard Protection users?
No. Google’s October 20, 2026 announcement ties the ClickFix copy warning to Safe Browsing Enhanced Protection, which users must turn on themselves. Standard Protection, Chrome’s default, is not covered by the copy-time check. Administrators can enforce Enhanced Protection across managed Chrome browsers through policy.
What does Chrome send to Google when I copy a command?
According to Google, when an Enhanced Protection user copies a suspicious command, Chrome removes personal information from the payload and sends it to Safe Browsing for a verdict. A warning appears only if Safe Browsing classifies the command as dangerous.
Is the macOS “Possible malware, Paste blocked” warning real?
Yes, Malwarebytes reported in March 2026 that macOS Tahoe 26.4 shows a Terminal warning reading “Possible malware, Paste blocked” when a user pastes a suspicious command. Axis did not find Apple documentation for the feature as of October 24, 2026. It applies to Terminal, not to other apps where a command could be pasted.
Why did ESET’s ClickFix numbers drop while Microsoft’s went up eightfold?
Both saw ClickFix fade in late 2025 and rebound in 2026; the difference is the size of the rebound. ESET counts blocked lure pages under one detection name, up 108% between H2 2025 and H1 2026. Microsoft counts devices where a ClickFix command actually ran, up roughly 23x between December 2025 and May 2026. Newer variants escape the older detection name but still show up as executions.
Is CAPTCHA-gated phishing the same as ClickFix?
No. CAPTCHA-gated phishing places a fake CAPTCHA in front of a credential-phishing page to block security scanners; the victim types a password. ClickFix uses a fake CAPTCHA or error to make the victim paste and run a command. Both exploit trust in “verify you are human” screens, and Microsoft counted 11.9 million CAPTCHA-gated phishing emails in March 2026 alone.
How much does a ClickFix kit cost criminals?
Microsoft Threat Intelligence reports ClickFix builder kits advertised on criminal forums since late 2024 at US$200 to US$1,500 per month, with individual components sold for US$200 to US$500. That pricing puts the technique within reach of low-skill operators.
Does disabling the Windows Run dialog stop ClickFix?
It stops the most common version. Huntress says Run dialog attacks make up 31% of its EDR SOC signals and that more than 90% of users in its sample never use the Run dialog. Variants that target PowerShell, Windows Terminal, the File Explorer address bar (FileFix), the macOS Terminal or a browser address bar (ConsentFix) need their own controls.
What is the MITRE ATT&CK ID for ClickFix?
T1204.004, User Execution: Malicious Copy and Paste, created on March 18, 2025, covering Windows, macOS and Linux. MITRE lists Contagious Interview, Havoc, Kali365, Kimsuky, MuddyWater and Vidar as procedure examples and maps detection to DET0340.
What is FileFix?
FileFix is a ClickFix variant in which the victim is told to paste the command into the Windows File Explorer address bar rather than the Run dialog or a terminal. Microsoft reported it gaining traction in its Digital Defense Report 2026. It sidesteps defenses that only watch Run or PowerShell, which is why disabling the Run dialog alone is not enough.
What is the Native Paste Defense Lag (NPDL)?
NPDL is Axis Intelligence Research’s measure of how many months passed between the first documented ClickFix campaign in March 2024 and a vendor’s first built-in, user-facing paste or copy warning. As of October 24, 2026: macOS 24 months, Opera 28, Chrome 31, and Windows at least 31 and still open.