It usually starts with something boring. A Cloudflare “verify you are human” box, a Teams page that won't load, an email saying your Microsoft account needs an urgent security update. Then a short set of instructions: press Win+R, paste, hit Enter.

Do that, and you've just installed the attacker's malware for them. No exploit is needed, and quite often there's nothing in the email for a gateway to flag.

Security people call this ClickFix. For a while it was mostly a cybercrime trick for spreading password stealers. Since late 2024, though, Iran-linked espionage groups have been using it against organisations in the Middle East, including one wave aimed mainly at the UAE and Saudi Arabia. More and more, the lure arrives through a partner or supplier people already trust.

So what is ClickFix, exactly?

The trick is simple. A web page shows you a fake problem and offers to fix it. When you click the fix button, the page quietly copies a command to your clipboard, then tells you how to “finish” the step: open the Run box, paste, press Enter. Some newer versions send people to Windows Terminal instead (Win+X, then I), and there are versions aimed at Mac users that use Terminal. Another variant, sometimes called FileFix, has people paste the command into the File Explorer address bar.

Because you're the one running the command, most of the usual defences never get a look in. Nothing is being exploited, and often there's no email involved at all. That goes a long way to explaining how common it's become. In its 2025 Digital Defense Report, Microsoft said ClickFix was the most common initial access method its Defender Experts team dealt with over the year, behind 47% of those incidents.

Who's using it in the region

The name that keeps coming up is MuddyWater. It's an Iranian espionage group that public reporting ties to the country's Ministry of Intelligence and Security (MOIS), and security vendors track it under a long list of names, including TA450, Mango Sandstorm, Seedworm and Static Kitten. It has been active since at least 2017 and goes after government, telecoms, defence, energy and finance targets across the Middle East.

Three campaigns show how its use of ClickFix has changed over time.

In 2024 the payload was a commercial remote-admin tool. By 2026 it's a custom backdoor that only ever decrypts in memory. Group-IB reports that MuddyWater now uses ClickFix alongside SEO poisoning through fake GitHub pages and voice phishing over Microsoft Teams (Group-IB).

Since the US and Israeli strikes on Iran on 28 February 2026, Iran-aligned and hacktivist activity aimed at the region has climbed sharply, with Unit 42 citing estimates of around 60 hacktivist groups active by 2 March.

The supply-chain angle

The lures that worry us most don't come from strangers. They come through people and platforms you already trust, so the usual red flags simply aren't there.

In the Israeli campaign, the phishing was sent from companies that had genuinely been breached, so it sailed through sender checks. On 14 September 2026, attackers got hold of a full-access Cloudflare API key that had been left in the source code of email marketing company Brevo. They used it to set up a Cloudflare Worker that rewrote the scripts Brevo's customers embed on their own websites, adding ClickFix code for several hours. Sansec estimated that up to 100,000 sites could have been exposed (BleepingComputer). In May, an unauthenticated SQL injection flaw in Ghost CMS (CVE-2026-26980) let attackers steal admin API keys and make more than 700 sites, many of them universities and tech companies, show fake Cloudflare checks (Malwarebytes). Neither incident has been tied to Iranian groups, but both show how the same lure can reach your staff through a vendor's code rather than a stranger's email.

How an attack plays out

The chain below is a composite of the campaigns and incidents above, not a single observed attack. Each attacker step on the left has a control on the right that can break it.

If you only fix one thing, make it step 4. Everything after it depends on someone pasting and running that command, so taking that ability away cuts off most of the chain.

What to do about it

Since the user is the one running the command, email and web filtering often don't help much. The controls that matter most sit on the laptop itself, and in how you deal with suppliers.

This week, if you run security:

01. Take the Run dialog away from standard users. The “Remove Run menu from Start Menu” group policy does it and, despite the name, also disables Win+R. It won't stop the Terminal or File Explorer routes, which is why the next step matters.

02. Use App Control for Business (formerly WDAC) or AppLocker to block powershell, mshta, cmd, wscript and cscript for standard users. Pilot it with a small group first, because login scripts and some business apps rely on cmd.

03. Turn off the WebClient service anywhere that doesn't need WebDAV. The PatchAgent chain relies on it to pull its payload.

04. Go through the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU). Anything that mentions powershell, odbcconf, conhost, msiexec, DavWWWRoot or a URL deserves a closer look. The Run box isn't the only place to look: PowerShell's history file (ConsoleHost_history.txt) and the Explorer TypedPaths key cover the Terminal and File Explorer routes.

05. Keep a list of approved remote management tools and treat anything else as an incident. MuddyWater has used Level, Atera, AnyDesk, Action1, PDQ, ScreenConnect and SimpleHelp.

With your suppliers and partners

01. Scan and sandbox links in partner emails the way you would for anyone else, even from suppliers you've worked with for years.

02. Agree a simple call-back routine with key partners, so an odd request gets checked over the phone before anyone acts on it.

03. Lock down the third-party scripts on your websites with a strict Content Security Policy and monitoring for script changes, and use Subresource Integrity where a vendor's script is stable enough to pin. If you take card payments, PCI DSS 4.0 requirements 6.4.3 and 11.6.1 already expect this on payment pages.

04. Keep CDN and CMS API tokens as narrow as you can: limited permissions, locked to known IPs and short-lived. Set up an alert for any new Cloudflare Worker or route. In the Brevo case, the attacker's Worker, routes and DNS records were created without triggering an alert.

For everyone else in the company

A real website, CAPTCHA or Microsoft update will never ask you to paste something into Run, PowerShell or Terminal. If you see that, stop and tell your security team.

If someone has already run it

Take the machine off the network and rebuild it. Then revoke every session, token and API key that was saved in its browsers. Changing passwords isn't enough on its own, because stolen session cookies keep working until they're revoked. Let affected partners know, and report it to your national cyber authority so the indicators can be shared around the region.

Where to start

ClickFix gets people to do the attacker's job, and a trusted supplier makes the request look routine. The steps it needs on the endpoint are predictable, though, and most of them can be switched off this week.

If you want to know how exposed your organisation is, this is the kind of work SISA does with teams across the Middle East, from hardening endpoints and reviewing third-party scripts to responding when something slips through. Get in touch with us at sisa.ai.