Clickfix phishing via browser dialog box
Identifies a ClickFix-style social-engineering phishing attempt and its FileFix evolution where a web page coerces a user into interacting with a trusted File Explorer address bar so that a clipboard-pasted value executes a command on the host. Attackers use convincing browser lures (fake CAPTCHAs, shared-file prompts, account-suspension pages, etc.) to cause the browser to open a native dialog or explorer window and simultaneously place a malicious command on the clipboard. When the user pastes that content into the trusted UI it runs with their privileges, often bypassing Mark-Of-The-Web checks and many automated protections.
- Platform: Windows
- Severity: High
- MITRE Tactic: Initial Access
- MITRE Techniques: T1566