# Threat Actors Prefer Repeatable Attacks Over Novel Exploits, Microsoft Research Shows
Microsoft's security research team identified ClickFix as the most common initial access vector across enterprise environments in 2024. The technique bypasses technical defenses by exploiting human behavior instead.
ClickFix works through a deceptively simple social engineering chain. A malicious webpage displays a CAPTCHA-style verification prompt. While the victim reads instructions, the page covertly places a command string into the clipboard. The attacker then verbally guides the target through opening a terminal application, pasting the clipboard contents, and executing the command. The victim believes they are completing a security verification. In reality, they have installed malware or granted remote access to their system.
This approach reveals a strategic shift in how threat actors operate. Rather than investing heavily in zero-day exploits or advanced technical attacks, adversaries focus on methods that work repeatedly across diverse organizations. ClickFix requires minimal technical sophistication from the attacker. It generates no network anomalies that traditional security tools catch. It avoids triggering endpoint detection systems. Most critically, it scales. A single ClickFix campaign can target thousands of victims simultaneously across different sectors and geographies.
The technique's effectiveness stems from psychological manipulation rather than technical novelty. Users trust terminal commands more readily when primed by an official-looking interface. The framing as a security check reverses normal threat suspicion. Victims who would reject a suspicious email link willingly execute code when told it proves their legitimacy.
ClickFix emerged as the top initial access method, surpassing traditional vectors like phishing attachments, credential theft, and unpatched vulnerabilities. This ranking carries significant operational implications. Organizations must recalibrate their security awareness training. Standard training about suspicious links and files proves insufficient when adversaries weaponize compliance with legitimate-seeming instructions.
The persistence of ClickFix across 2024 reflects fundamental economics of cybercrime. Developing reliable, repeatable attacks requires less resources than discovering new vulnerabilities. A threat actor who masters one effective social engineering technique can extract significantly more value than an attacker chasing CVEs and zero-days. Each successful ClickFix compromise often leads to lateral movement, data theft, or ransomware deployment worth substantial sums.
The research also underscores why threat actors rarely abandon proven methods. ClickFix works across Windows, macOS, and Linux systems with minor modifications. It works against both individual contractors and enterprise employees. It bypasses most technical security controls. Security teams that detect and block one ClickFix campaign simply face another variant using identical methodology weeks later.
Organizations defending against ClickFix require multi-layered responses. Technical controls include browser policies that restrict clipboard manipulation, terminal application restrictions, and behavioral analysis that flags suspicious command execution patterns. Human-centric defenses demand training that specifically addresses terminal-based social engineering. Help desk procedures need hardening to prevent attackers from social engineering legitimate support requests.
Microsoft's finding that repeatable attacks outperform technically sophisticated ones fundamentally challenges the security industry's focus on zero-day detection and patch management. While those remain important, organizations hemorrhaging users to ClickFix and similar repeatable social engineering tactics ignore the actual threat landscape. The most dangerous attacker rarely deploys novel code. They deploy familiar code that already defeated your defenses.