Microsoft attributed 47% of the initial-access cases its Defender Experts team handled in 2025 to a technique called ClickFix — a figure that turns a once-novel social trick into the dominant pathway into enterprise networks.
What ClickFix does and why it bypasses scanners
ClickFix begins with a seemingly ordinary web page that prompts a user to "fix" a problem — a verification check that will not complete, a document that fails to open, a browser rendering issue, or a warning that a Mac is low on storage. The page quietly writes a one‑liner "fix" to the clipboard and asks the user to paste it into a trusted local interpreter (Run, PowerShell, Terminal, File Explorer). There is no exploit, no attachment, and often no file to download; the authenticated user pastes a command into a signed, native binary, mimicking legitimate administrative work. CTM360 summarizes the clean instruction as a practical rule: "No legitimate website, verification check, error message, video call or software update will ever ask you to copy something and paste it into the Run box, PowerShell, Terminal, a command prompt or the File Explorer address bar."
EtherHiding on Polygon and infrastructure designed to survive takedown
CTM360 traced more than 17,000 infected URLs serving fake Cloudflare verification pages, roughly 3,000 of them still active at the time of analysis. Rather than embedding an attacker-controlled domain, the injected script makes a free, read-only call to a smart contract on the Polygon blockchain — a technique CTM360 calls EtherHiding. The contract returns an encoded string that decodes to the current lure hostname; no wallet, no transaction, no cost. In one day of observation the contract returned three different lure hosts in sequence while none of the compromised websites were modified, enabling near-instant rotation without a registrar or hosting provider to notify. The same on-chain and decentralized-resolution idea appears again later in the chain: Telegram channel descriptions and a Steam profile page were observed resolving the malware's command-and-control address. The design deliberately places multiple resolution mechanisms at different stages so that "no single takedown breaks it."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPer-visitor targeting, traffic distribution, and machine-gated payloads
The lure system reports each visitor's operating system and version back to an operator-controlled configuration service, which replies with per-platform landing pages and a per-visitor decision whether to show the lure. CTM360 observed Windows enabled in the sample, macOS and Linux pages present but differently configured, and mobile suppressed; a cookie suppressed the overlay for repeat visitors for 90 days. A traffic-distribution system polls the operator about every 1.5 seconds and can silently mark a session "verified" so researchers and crawlers see a clean page while intended targets see the malicious instruction.
Payload delivery is gated by hardware and account fingerprints: the dropper recovered from a live host encoded a machine GUID, volume serial, computer name, BIOS manufacturer, system model, GPU and username into the download path. The command-and-control server therefore knows the victim's identity before serving any payload and can return machine-specific content — or nothing — thwarting sandbox detonations and making detonation‑based verdicts unreliable.
From WordPress compromise to Vidar execution
WordPress domains were the predominant delivery substrate observed: genuine domains, valid certificates, and legitimate inbound traffic. On the host CTM360 examined the loader was not injected into a single page or theme file but appended by PHP to every dynamic response — identical across HTML, RSS and JSON — which points to a must‑use plugin that does not appear in the plugin list. The same site hosted roughly two dozen backdoor administrator accounts created by script; removing visible scripts and spam pages fixes none of it.
Two independent sample analyses converged on the same traffic-distribution API shape. One analysis stopped at a fingerprint‑gated dropper; the other followed the chain through three Telegram dead‑drop resolvers and two layers of AES decryption to Vidar Stealer executing inside a legitimately signed Microsoft binary via DLL side‑loading. CTM360 links this pattern to Sekoia's June 2026 analysis of the ErrTraffic framework, which identified the exact Polygon contract observed as belonging to an operator cluster that distributes Vidar; the framework is sold to affiliates for about $380 a month.
What this means for security teams, enterprises, and end users
- Security teams and SOCs: Controls that depend on recognizing attacker infrastructure — blocklists, domain takedowns, detonation verdicts — will decay within hours; behavioral constraints on what interactive users may execute remain effective across variants.
- Enterprise IT and procurement leaders: WordPress domains and must‑use plugins are core to the delivery business; remediation must go beyond deleting visible artifacts and include host‑level surveys for backdoor plugins and account creation scripts.
- End users: The single rule CTM360 highlights is simple and durable — do not copy and paste web‑provided commands into Run, PowerShell, Terminal, a command prompt, or the File Explorer address bar; if asked, assume the page is the attack.
Practical defenses proven to work in the chain
CTM360 organizes remediation around four chokepoints every campaign requires: the ability to write to the clipboard; the user's ability to open an interpreter; that interpreter's ability to reach the internet; and the persistence/exfiltration stage. Two underused controls stand out: blocking clipboard-write by default in managed browsers — which preserves the page's appearance but removes the easy one‑liner — and forcing script interpreters and fetch utilities through an authenticated proxy, which breaks staged chains on Windows, macOS and Linux without relying on any single indicator.
ClickFix has evolved from a novelty in late 2023 into a subscription product with on‑chain resolution, a state‑sponsored user base, and commercial distribution. Blocking domains will not stop it; changing how interactive users and interpreters can operate will. Will organizations now adopt the behavioral controls CTM360 says hold value across every variant? The report leaves that as the immediate operational question.
