ClickFix Attacks: A Simple Way to Reduce Risk
Cybercriminals are increasingly using a technique known as ClickFix, in which users are tricked into opening the Windows Run dialog (Windows Key + R), pasting a command, and unknowingly launching malware. Microsoft has observed these attacks being delivered through phishing emails, malicious websites, fake CAPTCHAs, and fraudulent support prompts. Because the user performs the requested steps, the activity can appear legitimate and may bypass some of the hesitation that normally accompanies an unfamiliar download or attachment.
A Practical Risk-Reduction Measure
As a security hardening measure, Kraft Kennedy can deploy a Group Policy (GPO) or Intune configuration that disables the Windows Run dialog across your environment. Removing this commonly exploited path can interrupt the specific sequence many ClickFix campaigns rely on, while still allowing organizations to evaluate exceptions for users or workflows that legitimately require Run access.
What This Helps With
- Prevents users from launching commands through Windows Key + R.
- Makes many ClickFix attack scenarios more difficult to execute.
- Adds another layer of defense against social engineering attacks.
What This Does Not Do
- Does not stop phishing emails.
- Does not stop malicious websites.
- Does not prevent all malware infections.
- Does not replace security awareness training, EDR, or other security controls.
Part of a Layered Security Strategy
This is not a silver bullet, but it is a practical step that can improve your organization’s security posture and reduce the likelihood of a user successfully following a ClickFix-style attack. It is most effective when combined with security awareness training, endpoint detection and response (EDR), email protection, web filtering, and other layered security controls.
If your organization would like to implement this control, please contact your Account Manager. Kraft Kennedy can review your environment, identify any operational considerations, and deploy the setting through GPO or Intune where appropriate.
Stay Connected
Looking for more ways to interact with Kraft Kennedy?
Check out our upcoming events!