Table of Contents
When our Threat Response Team (TRT) analyzed our recent engagement data, one finding stood out above everything else.
A single attack category accounted for the majority of our TRT engagements. Not a sophisticated zero-day. Not a nation-state intrusion.
Users. Searching. Google.
ClickFix and Search Engine Poisoning (SEO Poisoning) have become the number one initial access method we are responding to. Across our customer base spanning healthcare, legal, education, engineering, non-profit, and more, this is no longer an emerging threat. It is the dominant one. And as we will explain below, email plays a bigger role in enabling these attacks than most security teams realize.
First, What Are We Actually Talking About?
Before getting into the data, it helps to be precise about terminology, because these two techniques are closely related but describe different parts of the same attack chain.
SEO Poisoning is the manipulation of search engine results to surface malicious websites when users search for common software, tools, or brand names. Attackers either compromise a legitimate, trusted website and inject malicious content into it, or they create convincing fake pages and use paid Google and Bing advertising to push those pages above legitimate results. When someone searches for “QuickBooks download” or “LinkedIn login,” they may be clicking on a result that appears completely real and outranks the actual site.
ClickFix is the social engineering layer on top. Once a user lands on the malicious page, they are presented with a fake problem: a CAPTCHA that appears broken, a software verification prompt, or a “prove you are human” step. The user is then instructed to fix it by copying and pasting a command into their Windows Run dialog, PowerShell terminal, or browser URL bar. That command is malicious. The user runs it themselves, with their own credentials and permissions.
No exploit. No vulnerability. Just a person doing exactly what the page told them to do.
What We Saw in Our Own SOC Data
Across TRT engagements we analyzed, ClickFix and SEO Poisoning are the highest-frequency attack category in the dataset.
Every single case followed the same core pattern:
- A user performed a routine search or visited a familiar-looking page
- They were socially engineered into executing a malicious command
- A lightweight first-stage script ran on their machine immediately
- That script reached out to an attacker-controlled server to pull down a second-stage payload
That staging behavior matters. The initial command is not the weapon. It is the door opener. Its only function is to establish a foothold and phone home for instructions. What comes next is where real damage happens.
In the most severe case we investigated, the attack chain extended to four distinct stages:
- An MSI file installed from a remote server
- Persistence tools are delivered via custom archive files
- Command-and-control established through Telegram’s API (increasingly common because Telegram traffic blends with normal web activity)
- Attempted data exfiltration
In several other cases, our endpoint detection platform killed the process before the second-stage payload fully landed. Those outcomes look like “near misses.” In reality, they are proof of how thin the margin is between a contained incident and a serious breach. Combining endpoint detection and response technology with human expertise ensures these attacks are contained before they proliferate throughout a network.
Where Email Fits In
Here is the piece of this story that tends to be overlooked.
ClickFix and SEO Poisoning are categorized as web-based initial access. But in practice, email is often what puts the user in front of the malicious page in the first place. This matters enormously for how organizations think about their security architecture.
In several of the incidents we investigated, the sequence looked like this:
A user receives an email with a link. It is business-contextual: review a document, verify an account, and access a shared file.
- That link points to a page that is either the SEO-poisoned site directly or redirects through it.
- The user arrives at a legitimate-looking page and is presented with the ClickFix prompt.
- The malicious command executes on their machine.
The email itself does not host the malware. It does not ask for credentials directly. It does not look like the phishing email that security awareness training teaches employees to recognize. It is simply the vehicle that delivers the user into a dangerous web environment.
Where Email Security Comes into Play
This is why email security tools that only scan for traditional phishing indicators miss part of this threat. An email containing a link to a compromised but otherwise legitimate website will pass most filters. The URL may even be clean at scan time if the site had not yet been poisoned when the email was sent. By the time the user clicks, the page has been weaponized, and the delivery chain is complete. Leveraging an advanced managed email security service mitigates threats before they enter the mailbox, thwarting the attack before it is actualized.
The implication is important: organizations that treat email security and endpoint security as separate problems create a gap that attackers are actively walking through. Threat actors do not care about your security architecture. They thread the needle between your layers.
Who Was Targeted? Everyone.
One of the most instructive things about this data is how unremarkable the victim profile is. ClickFix and SEO Poisoning incidents in our dataset touched organizations across every vertical, including:
- Healthcare
- Legal services
- Engineering
- Education
- Non-profit
- Safety and security services
- Financial services
- Manufacturing
There is no industry pattern. No revenue threshold. No geographic clustering. No industry is immune. The attacker’s selection criteria are simple: whoever searched for the poisoned term.
This is by design. SEO Poisoning campaigns targeting widely used software brands cast the widest possible net. Threat actors do not need to know anything specific about your organization. They just need to know that someone at a lot of companies will search for that tool today.
If your employees use Google to find software, navigate to common platforms, or look up tools they use every day, your organization is in scope.
Why Capable, Careful People Fall for It
Understanding the threat means understanding why it works.
The ClickFix prompt is effective because it borrows authority from context. When a user is trying to accomplish a task and hits an unexpected roadblock, the instinct is to clear it and keep moving. The fake CAPTCHA and the verification prompt appear at exactly the moment of highest task focus. The user is not browsing aimlessly. They have a goal. The malicious page inserts itself between the user and that goal.
The instruction to open PowerShell and paste a command is normalized by the surrounding context of a professional-looking page. Many employees have legitimately followed IT support instructions that looked similar. The cognitive work required to distinguish “real instruction” from “social engineering trap” in that moment is higher than most security training prepares people for.
This is not a failure of intelligence. It is a feature of how these attacks are engineered. They are specifically designed to bypass trained skepticism. The mitigation cannot be “just train users better,” though user education still matters. The mitigation requires layered technical controls that catch what human judgment misses in a high-focus moment.
What Stopped These Attacks
In the cases we investigated, containment came from two places: endpoint behavioral detection that automatically killed malicious processes, and SOC-initiated host isolation following alert review.
In the majority of cases, the endpoint platform was the deciding factor. It killed the malicious process before the full payload chain completed.
What this means in practice: organizations running signature-based detection would have seen different outcomes. Signature-based tools do not catch novel ClickFix payloads. By definition, a new loader pulled from an attacker-controlled domain has no prior signature. Rather than relying on a known signature, the attacks were stopped by behavioral detection that identified a browser-launched PowerShell process contacting an external domain and attempting to change a registry key.
The cases where containment was hardest were the ones where each individual signal looked clean in isolation. The email passed by filtering. The website was a legitimate domain that had been compromised. The initial PowerShell command was short and obfuscated. Only the behavioral chain following execution revealed what was actually happening.
This is the argument for correlated, cross-signal detection across email, identity, and endpoint simultaneously. Not three separate tools with three separate alert queues. A connected view of what a user did: received this email, clicked this link, visited this site, ran this command, spawned this process. When you can see that sequence together, the attack is clear. When each step exists in its own silo, it looks routine until it does not.
What to Do About It
Based on what we saw across these eight incidents, here are the actions that would have reduced impact:
- Treat email links as potential SEO Poisoning entry points, not only traditional phishing vectors. A link to a currently clean website can become dangerous after the email is delivered. Time-of-click URL analysis, which re-evaluates a link when it is actually clicked rather than only at scan time, is how you catch compromised sites that were clean on delivery.
- Update your user awareness content specifically for ClickFix. Generic “do not click suspicious links” training does not address this threat. Employees need to understand one concrete rule: no legitimate website, software vendor, or IT team will ever ask you to open PowerShell and paste a command to prove you are human. If a webpage instructs you to do that, close the tab and report it.
- Verify that your endpoint detection is running behavioral analysis, not just signatures. Every contained case in our data was contained by behavioral detection. Organizations relying on legacy or signature-only endpoint protection would not have caught these attacks at the same stage.
- Close the visibility gap between email and endpoint. If your email security platform and endpoint detection do not share context, that gap is exploitable. A click event in email should be visible alongside the process activity that followed it on the endpoint.
- Have a host isolation playbook ready to execute in under five minutes. In cases where the second-stage payload executed, dwell time was measured in minutes. The variable that determined how much of the attack chain completed was SOC response speed. Fast isolation is not a nice-to-have.
The Bottom Line
ClickFix and SEO Poisoning represent a maturation of the attacker playbook. One that sidesteps the technical defenses most organizations have built and goes straight for the one control layer that is hardest to harden: human judgment under pressure.
Our data is unambiguous. This is the number one initial access vector we are responding to right now. It hits every industry. It works against trained, careful users. And it frequently has an email component that makes it a problem for every layer of your security architecture, not only the endpoint team.
The organizations that weathered these incidents best had three things in common: fast behavioral detection on the endpoint, a SOC watching for chains of events rather than individual alerts, and the ability to isolate a compromised host before the attack moved to its next stage.
