Malicious Copy and Paste (MITRE ATT&CK T1204.004) is a sub-technique of user execution. The adversary relies on a person copying code and pasting it into a command interpreter. MITRE files it under Execution and lists Linux, Windows and macOS.
The best-known version is called "ClickFix". It works because the victim does the final step on their own, by hand, believing they are fixing something.
How attackers use it
In a ClickFix lure the user sees a seemingly helpful solution, such as a prompt to fix an error or to complete a CAPTCHA. The instruction is to copy some text and paste it somewhere, and that text is the malicious code.
MITRE describes two delivery routes:
- Websites. Malicious sites, such as those used in drive-by compromise, show fake error messages or CAPTCHA prompts that tell the user to open a terminal or the Windows Run dialog and run a command.
- Email. When a user tries to open an attachment, they may see a fake error and be offered a command to paste as the fix.
The pasted commands may be obfuscated with encoding or other techniques so the user cannot tell what they do. Once the command runs, the adversary typically gets a foothold.
Why use this approach? MITRE says tricking a user into executing a command may help bypass email filtering, browser sandboxing and other mitigations designed to protect users from malicious downloaded files. Nothing is downloaded and opened. The user types, or pastes, the command into a tool that is allowed to run it.
The MITRE page lists several actors and malware families that used ClickFix style lures, and one case where legitimate device codes were generated and shown to a victim with instructions to paste them into a real authentication flow.
How to detect it
MITRE's detection strategy describes the chain on each platform.
Windows.
- The user is active in a browser, email or Office app.
- A command interpreter starts with suspicious arguments, such as base64 content, Invoke-Expression, a web download or a pipeline into a shell.
- Optionally a file drops in %TEMP% or %APPDATA%.
- An outbound connection goes to an external domain.
All of this happens in a short window and under the same user session.
Linux. A user pastes a one-liner or multi-line command into bash or zsh that downloads or decodes and executes content. Look for curl, wget, bash or sh with a pipe to an interpreter or a base64 decode, a temporary file under /tmp or ~/.cache, and immediate outbound traffic.
macOS. Terminal or iTerm2 spawns bash, zsh or python with suspicious pipelines or base64 patterns, followed by file writes in ~/Library or /tmp and outbound connections.
Two details help in practice. First, the Run dialog leaves a trace. On Windows, commands typed into Run are recorded under the RunMRU registry key for each user. Second, command line logging matters here more than file scanning, because there may be no file at all.
How to reduce the risk
MITRE's mitigations:
- Use application control where appropriate. PowerShell Constrained Language mode can limit access to sensitive language elements, such as those used to run arbitrary Windows APIs or files (Add-Type, for example).
- Use network intrusion prevention and systems that scan and remove malicious downloads, to block requests the user makes to attacker links.
- Restrict web-based content. Block unknown or unused file types in transit by default, such as .scr, .exe, .pif and .cpl.
Beyond the list, user awareness is the control that matches the technique. People need a simple rule: no website or email legitimately needs you to paste a command into a terminal or the Run box to fix an error or prove you are human.
Check your own environment
- Do you log PowerShell script blocks and process command lines on endpoints?
- Do you have a rule for the Run dialog or Terminal launching an interpreter with encoded content?
- Is PowerShell Constrained Language mode used on machines where full language is not needed?
- Does your security awareness material include ClickFix examples, with screenshots?
- Can the helpdesk hear "a website told me to paste something" and know what to do?
Two read-only checks on Windows. This shows the PowerShell language mode of the current session:
$ExecutionContext.SessionState.LanguageMode
This lists what the current user has typed into the Run dialog:
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Treat the second as a hunting aid. A long encoded string in Run history is worth a conversation.
Quick check
Why might ClickFix get past email filtering and browser sandboxing?
No malicious file is downloaded and opened. The user pastes and runs the command themselves in a tool that is allowed to run it, which sidesteps controls built around malicious downloads.
Which log source matters most for this technique?
Process creation with command line, plus script block logging. There may be no file for a scanner to see, so the command content is the evidence.
What does PowerShell Constrained Language mode do here?
It restricts access to sensitive or dangerous language elements, such as those used to run arbitrary Windows APIs or files, which limits what a pasted command can do.
