⚠️ Security Warning

ClickFix lures can lead to malware and computer viruses. If you see text like this online, it's likely a scam.

Back to Techniques

powershell.exe

powershell.exe is a powerful command-line shell and scripting language built on the .NET framework. It provides full access to COM objects, WMI, and the file system. Due to its extensive capabilities, it's frequently abused by attackers to execute malicious code, download payloads, and establish persistence. Nation-state actors like Russia's COLDRIVER (UNC4057, Star Blizzard) have been observed using ClickFix techniques with PowerShell to deliver malware like LOSTKEYS against NATO governments, NGOs, and journalists.

windows cli MOTW UAC

Fix Windows Security Update

Try Example
MOTW

Your Windows security is out of date. Apply this critical update to protect your system:

  1. Press Win-R on your keyboard

  2. Type powershell and press Enter

  3. Press Ctrl-V to paste the security update command

  4. Press Enter to execute

References:

Mitigations:

  • Enable PowerShell logging and script block logging

  • Implement PowerShell Constrained Language Mode

  • Never run PowerShell commands from untrusted sources

  • Be suspicious of any request to run PowerShell for 'security updates'

Contributor: Michael Haag (2025-09-09)

Fix Network Configuration

Try Example
UAC

Your network configuration needs to be updated to maintain connectivity. Apply this fix:

  1. Press Win on your keyboard

  2. Type powershell and press Ctrl+Shift+Enter

  3. Click Yes when prompted

  4. Press Ctrl-V to paste the network configuration command

  5. Press Enter to execute

References:

Mitigations:

  • Enable PowerShell logging and script block logging

  • Implement PowerShell Constrained Language Mode

  • Never run PowerShell commands from untrusted sources

  • Be suspicious of any request to run elevated PowerShell for network fixes

Contributor: Michael Haag (2025-09-09)