Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting

The article describes a social engineering technique called ClickFix, where a web page posing as a bot check walks users through copying and pasting a pre-populated command from their clipboard into a terminal, giving attackers repeatable initial access. This is framed as a highly effective, low-friction method that was reportedly one of the most common initial access vectors seen by Microsoft’s team last year. From a RealGround perspective, any workflow where users follow on-screen instructions from automated systems (including AI-driven support, agents, or assistants) to run commands or change configurations creates a channel for AI agent abuse and attack chaining. Organizations should red team AI-assisted support and self-service flows to ensure they do not normalize unsafe behaviors (like pasting unverified commands) and should implement guardrails, verification steps, and logging to detect and prevent such repeatable social-engineering-based access paths.