I've been seeing more ClickFix attacks where a fake CAPTCHA or verification page tricks someone into opening Run, PowerShell, or Terminal and pasting in a command. That seems different from traditional awareness training about avoiding suspicious attachments or downloads—the user is persuaded to execute the malicious command themselves, often from a site they believe is legitimate. Years of copy-paste troubleshooting instructions may also have made "open PowerShell and run this" feel normal. For those managing business environments, what are you doing about this specifically? Are you relying on user training, EDR detections, restricting PowerShell or Run, application control, clipboard protections, email defenses, or some combination?
4 Answers
We had an endpoint trigger this kind of attack, and both our EDR and Defender detected and quarantined it. We rebuilt the machine afterward to get back to a known-good state. We also disabled the Run dialog for standard users through management policy. PowerShell is still available in our environment, so we’re looking at additional controls rather than assuming that blocking Run solves everything.
Using multiple security products can provide defense in depth, but the important part is making sure their policies are actually enforced and monitored.
Restricting Windows+R through Group Policy, Intune, or a keyboard-filtering policy can remove one common delivery path. Some organizations also restrict command shells and PowerShell for ordinary users, while allowing approved administrative workflows. Be careful with blanket PowerShell blocking because endpoint-management and business tools may depend on it. User training should explicitly say that no legitimate CAPTCHA or support page should ever ask someone to paste commands into Run, Command Prompt, or PowerShell.
The baseline controls still matter: standard users should not have local administrator rights, and a properly configured EDR such as Defender or CrowdStrike should detect many of these payloads. But lack of admin access is not a complete defense—malware can still steal browser data, access user files, and establish a foothold without elevation. Application control and allowlisting provide another useful layer.
Email defenses help with the lures that deliver these pages. Enforce SPF, DKIM, and DMARC for your domains, preferably with a rejecting policy once reporting shows legitimate mail is aligned. Add lookalike-domain and impersonation detection, plus clear external-sender banners. That will not stop a malicious website by itself, but it reduces convincing messages pretending to come from internal IT or a document service.
Rebuilding the device may sound excessive, but it guarantees that you return it to a clean, verified image when replacement hardware is available.