Quick links
Press Enter to search, Esc to close
Attack technique
Malicious Copy and Paste lets an attacker run code without an exploit and without a browser download.
In short
Malicious Copy and Paste lets an attacker run code without an exploit and without a browser download. The user pastes the command into a terminal or the Windows Run box. MITRE names ClickFix, where a fake error or CAPTCHA tells the user to do exactly that, as one such strategy.
Execution · Step 4 Of 15 In The Attack Chain
MITRE says an adversary may rely on a user copying and pasting code to gain execution. In a ClickFix attack, the user is socially engineered, often with a fake error message or CAPTCHA. The user opens a terminal or the Windows Run dialog box and runs a command. The command may be obfuscated with encoding. MITRE also notes that adversaries may use phishing emails, where an attachment shows a fake error and offers a command as the fix.
MITRE adds that tricking a user into executing the command may help to bypass email filtering, browser sandboxing and other mitigations built to stop malicious downloaded files. Google makes the same point for Chrome: the command runs in a terminal, not in the browser, so download protections do not see it. For the wider exploitation picture, CISA’s Known Exploited Vulnerabilities catalog now lists a flaw that Siemens ties to a ClickFix campaign.
MITRE lists Contagious Interview, Kimsuky and MuddyWater as groups that used ClickFix type tactics. It lists Havoc, Vidar and Kali365 as software that used the technique. Forescout reports it as the first step of ROMULUS, a delivery platform that runs a PowerShell stager after the paste (see the ROMULUS profile). Siemens ties the exploitation of CVE-2026-110936, now in CISA's Known Exploited Vulnerabilities catalog, to a ClickFix campaign. Our ClickFix this week post joins the three.
MITRE's detection strategy for this technique looks for a user who is socially engineered to open the Run dialog or a terminal. The user then pastes an obfuscated one-liner. Alert on PowerShell or cmd started by explorer.exe or a browser shortly after a page was opened.
Forescout advises hunting for PowerShell started with -NoProfile, -ep bypass or -w hidden plus a URL, and for long scripts run from the TEMP folder.
Forescout says to search command lines and script logs for http or https followed by 8 to 10 digits, which is an IP address written as one number.
Forescout advises flagging silent msiexec installs started from the TEMP folder, especially after Unblock-File. The ROMULUS profile lists the other follow-on hunts.
MITRE mitigation M1038 (Execution Prevention) suggests application control where appropriate, and PowerShell Constrained Language mode to restrict dangerous language elements.
MITRE mitigations M1031 (Network Intrusion Prevention) and M1021 (Restrict Web-Based Content) point to blocking malicious downloads and unknown file types from suspicious sites.
Google says Chrome now detects when an Enhanced Protection user copies a suspicious command. Chrome sends a cleaned copy to Safe Browsing and shows a warning on a dangerous verdict. It covers users who turned Enhanced Protection on.
Siemens tells everyone never to paste a command from a web page into Win+R, the Run box or PowerShell. It notes that a real I am not a robot check never asks for this.
It is the MITRE ATT&CK sub-technique Malicious Copy and Paste, under User Execution. The user is tricked into pasting and running a command, which MITRE links to the ClickFix strategy.
MITRE names ClickFix as one strategy under the technique. The technique also covers phishing emails that offer a command as the fix for a fake error.
Google says the pasted command usually starts tools like PowerShell or cmd.exe, so the malware is fetched from a terminal and not from the browser.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
