CrowdStrike warns of rising ClickFix social engineering attacks

CrowdStrike researchers have reported an uptick in 'ClickFix' attacks, a social engineering technique where users are tricked into copying and running malicious commands under the pretense of troubleshooting common IT issues. The company observed that groups like STARDUST CHOLLIMA and VOODOO BEAR have used ClickFix in real-world incidents. CrowdStrike's data show a 563% rise in fake CAPTCHA-related attack attempts in 2025.

• ClickFix attacks use fake error or CAPTCHA prompts
• Victims instructed to copy and run malicious commands
• CrowdStrike attributes attacks to multiple threat groups
• Incident rate for fake CAPTCHAs rose 563% in 2025