It started like a normal workday. An employee at one of our clients sat down at their computer, opened their email, and got some work done. Around mid-afternoon, they opened a browser to look into converting some cryptocurrency on a quick personal break. What they didn’t know was that the website they landed on was a trap, and what happened next is something we’re seeing more and more: an attack that doesn’t require a hacker to break through your firewall or steal your password. It just requires a few seconds of misplaced trust. Here’s how it unfolded, and how we stopped it
The Attack: A Website That Lied
The site looked legitimate enough. When the employee tried to use it, they were presented with a CAPTCHA, one of those “prove you’re human” challenges you see all over the internet. It failed. Then it failed again. Then, instead of a third CAPTCHA, the site displayed a helpful-looking message:“Verification failed. To complete verification, please press Windows + R on your keyboard, paste the following command, and press Enter.”The instructions looked like a website helping you fix a technical problem. The employee followed them, and in doing so, unknowingly told their computer to reach out to a server controlled by attackers and download malicious software.This is called a ClickFix attack. It’s one of the fastest-growing cyberattack methods in use today, and it works precisely because it doesn’t look like a cyberattack.
Why ClickFix Works
Most people think of hacking as something that happens to a computer from the outside. ClickFix flips that entirely. Instead of fighting through your technical defenses, attackers bypass them by convincing a real person with legitimate access to do the work for them. The fake CAPTCHA is the setup. The command prompt is the execution.This also illustrates exactly why Acceptable Use Policies (AUPs) matter. An AUP sets clear expectations for how company devices and networks should be used, including boundaries around personal activity on work equipment. In this case, a personal errand on a work device opened the door to a potential breach. A well-communicated AUP won’t eliminate human behavior, but it does establish accountability, reduce exposure, and give your IT team the framework to respond when incidents occur. That said, even the best AUP won’t stop every employee from checking something personal on a work device. People are human. That’s exactly why policy alone is never enough, and why what you have in place technically matters just as much.
What Stopped It: Layers Working Together
When the employee ran that command, multiple things happened almost simultaneously, all part of the security infrastructure Airspeed IT had in place for this client.
Endpoint protection intervened first. Before the malicious software could finish downloading, our endpoint security platform identified the command as a known threat and blocked it. The employee tried once more, thinking it hadn’t worked. It was blocked again. The payload never ran.
Nothing was installed. No data was touched.
24/7 monitoring caught the behavior in real time. Our security operations team detected the suspicious activity at the same moment the endpoint did. Within minutes, the workstation was isolated from the network as a precaution, and Airspeed IT was on the phone being briefed.
We responded immediately. We notified the client’s leadership within the hour and began a thorough investigation: sign-in logs, audit trails, email records, cloud account activity. We traced the full attack from start to finish and confirmed no passwords were stolen, no data was accessed, and no other systems were involved.Because nothing got through.
What We Did Next
With the investigation complete, we moved into remediation. The attacker’s server was blocked at the firewall. The affected workstation was scheduled for a clean rebuild. And we deployed a preventive control across the entire client environment that disables the specific Windows feature ClickFix depends on, so even if an employee encounters a fake CAPTCHA in the future, the attack has nowhere to go.We also scheduled end-user awareness training. The employee did nothing wrong by normal standards. These attacks are designed by professionals to be convincing. But awareness is a powerful layer of defense, and knowing what a fake CAPTCHA prompt looks like can make all the difference.
What This Means for Your Business
A few takeaways worth considering:
Policy and technology have to work together. An AUP tells your team what’s expected. Security tools protect you when those expectations aren’t met. You need both. Neither alone is sufficient.
The threat can come from anywhere. The employee wasn’t doing anything work-related when they encountered this attack. Cyberattacks don’t wait for business hours, and any device on your network is a potential entry point.
Speed matters more than you think. From detection to containment was under two minutes. From containment to client notification was under 25 minutes. That speed is not an accident. It’s the result of 24/7 monitoring and defined response procedures. Without that, this story could have ended very differently.
Layered security is what makes the difference. No single tool stopped this attack. Endpoint protection, real-time monitoring, and experienced human response each played a role. Remove any one layer and the outcome might have been different.
Are You Protected?
If you’re a business owner reading this and you’re unsure whether your team has these layers in place, that’s worth a conversation. ClickFix attacks are increasing in frequency and are being used to deliver ransomware, credential stealers, and remote access tools across businesses of every size and industry.Airspeed IT specializes in managed IT and security services for businesses that want enterprise-grade protection without the complexity. We’d be glad to start with a conversation about where you stand.
[Contact Airspeed IT →]
Airspeed IT LLC is a managed IT services provider serving businesses that demand reliable, secure, and responsive technology management.Most businesses that have been burned by inconsistent IT support describe the same experience. Something breaks. They call for help. A technician shows up — or dials in — who has never worked on their systems before. They spend the first 30 minutes asking questions your last technician already asked. They fix the immediate problem. The next time something breaks, a different person shows up and starts from scratch again. Nobody builds any institutional knowledge of your environment. Problems that should be caught early get missed. Things that were previously resolved break again because nobody documented the fix. The cost of all this is real, and most businesses significantly underestimate it.
The Hidden Costs of Technician Roulette
The obvious cost is the time your employees spend waiting for problems to be resolved. But the less obvious costs add up fast.
When a technician does not know your environment, troubleshooting takes longer. A technician who has worked in your systems for two years knows immediately that your accounting software throws a specific error when a particular service restarts, and they know the fix. A technician who has never been in your environment does not. The diagnostic time alone can be 3 to 4 times longer for an unfamiliar environment.
Repeat problems are a direct consequence of high technician turnover. If the person who fixed your problem last time is not the person who shows up next time, and nobody documented the root cause or the resolution, the same problem recurs. You pay to fix it again. And again.
Security gaps grow in environments with inconsistent IT support. When nobody owns the full picture of your IT environment, things get missed. A server that should have been patched months ago has not been touched. A security configuration that was changed by a previous technician was never reviewed. An account for a former employee was never disabled. These are not dramatic failures — they are the quiet, mundane security risks that accumulate over time and eventually create a serious incident.
Employee frustration is a real cost too. People who deal with constant IT problems and inconsistent support burn time, lose confidence in the company’s ability to function, and in some cases leave. The downstream cost of losing a key employee because their technology environment was a constant source of friction is hard to quantify, but it is not zero.
Why the Technician-Roulette Model Persists
Many IT providers — especially larger ones — staff on a dispatch model. They have a pool of technicians and assign whoever is available when a ticket comes in. This is operationally efficient for the provider, but it is the opposite of efficient for the client. The client pays the cost of re-education every single time.
Some businesses accept this as the nature of IT support, not realizing that a different model exists. A dedicated team model — where the same people manage and support your environment over time — produces materially better outcomes. It is not a premium tier product. It is just a different way of structuring the relationship.
At Airspeed IT, the reason we use the phrase "one team, every time" is because we have watched what happens when businesses do not have that. The costs are real and they are preventable. We think you should know who is going to pick up the phone before something goes wrong.
What the Alternative Looks Like
When the same team manages your environment over time, institutional knowledge accumulates. Your technicians know your systems, your users, your quirks, your history. They know that your CPA firm runs a critical reporting process every Friday afternoon and that is not the time to push a software update. They know that one particular machine has a persistent hardware issue that has been documented and scheduled for replacement. They catch small problems before they become big ones because they know what normal looks like for your environment.
Response is faster. Resolution is more consistent. Fewer things fall through the cracks. The relationship is more like having an internal IT team than calling a hotline and hoping someone competent picks up.
If you have been stuck in the technician-roulette cycle with your current provider, we are happy to have a straight conversation about what a dedicated-team model looks like and whether it makes sense for your business.
