As the Fresher’s Week hangovers fade and students across country turn their focus to the new academic year, so-called ClickFix social engineering scams targeting Britain’s higher education sector are kicking into high gear, according to academic IT and network services provider Jisc.
Amid the customary annual surge in phishing expeditions, Jisc said it is tracking a large number of ClickFix scams through its security operations sector (SOC) and cyber security incident response team (CSIRT)
ClickFix scams work by convincing users to copy, paste and run a certain set of commands on their system, usually to address and resolve a supposed technical issue. In doing so, they in fact run malicious applications that give threat actors access to the underlying network.
The organisation claims it has blocked between 300 and 37,000 phishing attacks every week against British colleges, research bodies and universities since the start of the current academic year – many of these emails will have been the precursor to a ClickFix scam.
“Cyber criminals are constantly innovating new ways to gain access to networks. All organisations should ensure that employees and students are aware of ClickFix scams, and that no legitimate Catcha or verification check will ask users to copy, paste and run commands,” said Jisc head of security intelligence and capability, Nicole Stewart.
According to recent Microsoft disclosures, ClickFix attack volumes spiked more than 20 times between December 2025 and May 2026, with malware payloads following 96% of the time. Between February and May of this year, ClickFix user-pasted command execution was observed on over a million unique devices.
Multiple threat actors are known to leverage the ClickFix technique, which has proved highly effective since it bypasses most technical security measures.
The most prolific proponents of ClickFix attacks use them to deliver infostealers, such as LummaStealer – in the education sector such tools would be used to target research data for exfiltration, potentially by nation-state actors.
However, other threat actors have been observed using ClickFix attacks to deliver remote access trojans (Rats) such as Xworm, AsyncRAT, NetSupport and SectopRAT for hands-on keyboard activity, loaders suh as Latrodectus and MintsLoader to deliver additional malware and payloads, and even rootkits to allow their users to establish long-term persistence.
Microsoft said it has seen 23-fold growth in ClickFix volumes between December 2025 and May 2026, with malware payloads following 96% of the time while between February and May of this year, ClickFix user-pasted command execution was observed on over a million unique devices.
Jisc noted that some ClickFix scams now also store their malicious payloads on blockchain smart contracts instead of the threat actors’ own servers, which makes it considerably harder
Some variants are now also able to exploit the WebRTC standard for browser-based video calls and peer-to-peer data transfers, opening up a new avenue of attack.
Meanwhile, according to Microsoft, artificial intelligence (AI) techniques are now being used to manufacture ClickFix lures at scale – one 2025 campaign spread ClickFix activation steps via AI videos on TikTok, some of which were viewed more than half a million times.
Next steps
For defenders, prioritising user awareness and equipping people with the knowledge to identify and ward off social engineering attacks should be the first and most effective line of defence.
In particular, users should be made aware that legitimate websites or update tools will never ask them to copy and run code through the clipboard themselves. Any such prompts should be treated with extreme caution and IT security teams notified for assistance.
This said, acknowledging that even the most security-conscious people make mistakes from time to time, there are some technical steps that security teams can take to reduce the likelihood of an attempted ClickFix attack becoming a full-blown incident.
As a first step, security teams should enable browser-layer security protections wherever possible, and clamp down on user access to the Windows Run dialogue, PowerShell, or other living-off-the-land binaries (LoLbins). Where possible, endpoint telemetry should also be monitored to detect any process creation events launched via the clipboard feature.
