Jurnal · Anton Kusnadi

Cybersecurity··8 min

ClickFix: The Attack That Needs No Vulnerability

A dark stone plinth holding a single blank keyboard key, lit from one side, its surface worn smooth from use.

Executive Summary

There is a slide in almost every security review I have seen that shows patch compliance at ninety-something percent, and a second slide showing phishing simulation pass rates trending the right way. Both are real achievements. Neither would have made the slightest difference to what happened in Berlin.

On 17 August 2026, Berlin disclosed that two Senate departments had been breached. By early September, the ransomware group Rhysida had published roughly 1.44 million files. When Germany’s Federal Office for Information Security published its analysis of how the attackers got in, the answer was not a CVE, an unpatched appliance, or a zero-day. It was a webpage with a fake Cloudflare CAPTCHA on it.

How the ClickFix Chain Actually Works

The technique BSI identified is a variant it calls TerminalFix, part of the broader ClickFix family that Microsoft warned about in February 2026.

A phishing email carries the target to a prepared page. The page displays what appears to be a routine bot check — the Cloudflare-style “verify you are human” box that most office workers now clear several times a week without reading. Instead of a checkbox, the page presents instructions: press Windows and X, then press I.

That key sequence opens Windows Terminal. The page’s JavaScript has already written a command into the system clipboard. The instructions tell the user to paste and press enter. They do, and the command runs with their privileges, on their machine, inside the network.

In the older ClickFix pattern the payload landed through the Run dialog and compromised one endpoint. TerminalFix opens a full terminal and establishes a reverse tunnel, which converts a single tricked employee into a foothold across the estate. Reporting on the BSI analysis notes the implant re-checked its persistence every sixty minutes and concealed its files and directories from Windows Explorer. In Berlin, that foothold was enough to reach two departments on a network connecting roughly 600 sites.

Data left between 7 and 12 August. The intrusion was found on 14 August, two days after the exfiltration had finished.

Why the Security Stack Does Not See It

Walk the controls one at a time.

The mail gateway sees only a link; the destination page is often clean at delivery time. The attachment sandbox has nothing to detonate, because there is no attachment. The web proxy sees a page that renders a CAPTCHA, which is what a large fraction of legitimate pages also do. The patch programme is irrelevant; no software defect is involved at any step. Endpoint detection sees Windows Terminal launching from an interactive user session and executing a command that user typed — which is, on a developer or administrator workstation, a description of an ordinary Tuesday.

There is no anomaly in the chain until after the foothold exists. The user supplied the execution, and the user was authorised.

By the time this attack is running, every preventive investment on the balance sheet has been bypassed rather than defeated. The controls that change the outcome were chosen months earlier.

The Part That Should Worry Executives Most

BSI noted that public administrations are attractive targets partly because staff names and email addresses are published by law. The attacker does not need to research the organisation. The organisation has already published its own target list, and transparency obligations require it to keep doing so.

Indonesian executives should read that with their own context in mind. State-owned enterprises, registered electronic system operators, and regulated financial institutions all publish officer directories. Every listed company publishes its management. And for organisations with no statutory disclosure at all, LinkedIn has performed the same service voluntarily, complete with job titles that reveal who has administrative access.

The targeting surface is therefore not something a security programme can reduce. It can only assume the list is fully public and plan accordingly.

Four Controls That Actually Address This

Awareness training is the reflexive answer and it is the weakest one, because this attack does not depend on the user being careless. It depends on the user being cooperative — the same gap between passing a compliance checklist and holding a genuine security culture that keeps showing up whenever the control on paper and the behavior on the floor diverge. The controls that work do not depend on the employee making a better decision under pressure.

Control 1: Remove the Shell From Desktops That Never Needed One

The overwhelming majority of staff in a finance, operations, or administrative function have no legitimate reason to open Windows Terminal or PowerShell. Where the shell is not present, the instruction on the fake CAPTCHA page simply fails.

  • Inventory which roles genuinely require a command line — it is a smaller list than assumed
  • Apply application control so the shell is unavailable to the rest
  • Treat exceptions as named, reviewed, and time-limited rather than permanent

Control 2: Make Clipboard-to-Shell a Detection Signal

A command arriving in a terminal within seconds of a clipboard write, in a session belonging to a user with no scripting history, is a strong signal. It is also a signal almost nobody collects.

  • Alert on first-ever terminal execution by a user account — the fact of execution is the signal, regardless of the command
  • Watch for terminal sessions that begin immediately after browser activity
  • Log and review outbound tunnel establishment from workstation subnets

Control 3: Train the Pattern Itself

Phishing training built around suspicious attachments and misspelled domains does not cover an instruction to press Windows and X. The rule worth teaching is narrower and more durable: no legitimate website will ever ask you to type or paste anything into a terminal. That single sentence covers ClickFix, TerminalFix, and every variant that follows, because the family is defined by that step.

  • Replace generic awareness modules with the one rule that generalises
  • Give staff a path to report a suspicious verification prompt that takes ten seconds to use
  • Measure reporting rate rather than click rate; the first is a capability, the second is a proxy

Control 4: Assume the Directory Is Public

Since the targeting list cannot be withdrawn, the compensating control is to make privileged accounts harder to map to public identities.

  • Separate administrative identities from the named accounts that appear in public directories
  • Apply phishing-resistant authentication to the administrative set first
  • Remove standing privilege, so a compromised session inherits far less than it used to

The Mistakes I Keep Seeing

1. Reporting patch compliance as a measure of exposure. It measures one attack class. Berlin’s patch position was not the problem, and a board reading only that slide would have concluded the organisation was well defended.

2. Buying another detection product after an incident like this one. The chain produced no detectable anomaly before the foothold. A tool that inspects attachments and links more aggressively does not see a user typing.

3. Treating this as a training failure. The employee followed on-screen instructions during what looked like a routine verification. We spent a decade conditioning exactly that behaviour, then blamed the person who exhibited it. Incident response that begins with blame also ends with under-reporting, which is the more expensive outcome.

Questions Executives Are Asking

Would multi-factor authentication have prevented this?

Not at the entry point. The attacker did not authenticate as anyone; the code ran inside a session the employee had already opened legitimately. Phishing-resistant MFA matters greatly for what happens next — lateral movement and privilege escalation — but it does not address the initial execution.

Our staff are technical. Is that protective?

It is closer to the opposite. Technical staff have terminals open routinely, are accustomed to pasting commands from documentation and internal wikis, and hold the privileges worth stealing. The population most comfortable with the requested action is the population where the action does the most damage.

Is this specific to Windows?

The family is not. The pattern is a webpage persuading a user to execute attacker-supplied text on their own machine, and equivalents exist for macOS and Linux using the terminal application. Windows Terminal is simply where the volume is, because that is where the corporate desktops are.

How would we know whether this has already happened to us?

Look for terminal or shell execution by user accounts with no prior history of it, and for outbound tunnels originating from workstation subnets. Both are cheap to query and neither is standard practice. The absence of a finding is weak evidence, which is itself the argument for collecting the signal before you need it.

What This Changes

The security industry has spent thirty years building controls that sit between an attacker and a machine. ClickFix does not go between them. It goes around, through a person who was doing what the last decade taught them to do, and it arrives with valid credentials and no exploit to detect.

The existing stack is incomplete in a specific and now well-documented way. Ransomware governance at board level has to account for an attack class where the honest answer to “were we patched” is yes, and it did not matter.

The next fake CAPTCHA will look exactly like the last real one. That is the entire design.