⚠️ Security Warning

ClickFix lures can lead to malware and computer viruses. If you see text like this online, it's likely a scam.

Back to Techniques

ssh.exe

ssh.exe is the Secure Shell client executable for Windows, a program used to establish encrypted, secure connections to remote computers over a network. In ClickFix-style attacks, the SSH ProxyCommand option is abused to run malicious commands locally.

windows cli CLI UAC

Verify You Are Human

Try Example
CLI UAC

Verify you are human by completing the action below

  1. Press Win-R on your keyboard

  2. In the verification window, press Ctrl-V

  3. Press Enter

References:

Mitigations:

  • Restrict ssh execution through application control

  • Monitor for suspicious ssh command lines, especially with ProxyCommand options

  • Never run commands from untrusted sources

Contributor: Carson Williams (2025-10-09)