Malicious Copy and Paste (ClickFix)

ClickFix lures (for example, fake errors or CAPTCHAs) persuade a user to copy and run a command. ATT&CK maps T1204.004 to Linux, Windows, and macOS; common Windows prompts direct users to the Run dialog, Windows Terminal, or PowerShell, while observed campaigns have also targeted macOS with a platform-specific command. FileFix is a related Windows variant that uses a browser file-upload interaction to open File Explorer and prompt the user to paste clipboard text into its address bar. One reported FileFix variation describes a downloaded executable losing Mark of the Web when launched through that address bar; this is specific to the reported flow and does not establish an inherent ClickFix MOTW bypass. The user must execute the command, but an Internet-delivered lure can target users without internal network access or an existing execution foothold. The benign marker step below is a Windows telemetry check only; it does not simulate a lure, clipboard write, FileFix flow, or payload.