ClickFix attacks are surging, and Microsoft says you are the only defense

"The tech giant published its latest Microsoft Digital Defense Report on Thursday. On average, Microsoft processes over 100 trillion signals every day, blocks approximately 4.5 million new malware attempts, screens 5 billion emails for malware and phishing, and scrutinizes approximately 38 million identity risk detections, which grants the company the data needed to provide a thorough overview of current cybercriminal trends, tactics, and techniques."

"Since early 2024, Microsoft has tracked ClickFix attempts and observed its increase in popularity. Over the past year, ClickFix has become a widely adopted initial attack technique, attempting to lure users into scamming or putting themselves at risk by tricking them into launching malicious code. This social engineering technique can be adapted for various access scenarios, but in general, ClickFix tries to take advantage of human problem-solving."

Microsoft's 2025 Digital Defense Report shows rising AI abuse, extortion attempts, and ransomware infections. Microsoft processes over 100 trillion signals daily, blocks about 4.5 million new malware attempts, screens 5 billion emails for malware and phishing, and scrutinizes around 38 million identity risk detections. ClickFix is identified as a widely adopted initial attack technique that surged since early 2024, recorded in 47% of initial access attempts. ClickFix lures users with fake error messages that prompt copying and pasting code or running commands, exploiting human problem-solving. Traditional phishing protections are insufficient against ClickFix, so changing user behavior is required to reduce risk.

Read at ZDNET