Security Decision Lab / ClickFix
ClickFix: Would you complete this verification check?
This fictional exercise explores ClickFix, a social engineering technique documented by Microsoft. An invoice link leads to a familiar-looking verification page. What would you do next?
Free. No account. Your choices stay in this browser tab and clear when the page reloads.
Case 02 / The verification check
The document is waiting.
The page wants one more step.
You help with invoices. A familiar supplier name and a verification check seem routine. Decide what to do when the instructions change.
Fictional exercise. Your clipboard is untouched. No commands, downloads or real verification checks run as part of the story.
HARBOR SUPPLIES / DOCUMENTS
Your invoice is ready
Verify you are human
Document accessComplete verification to continue to your document.
Illustration only. Use the exercise choices below. No real verification service, command window or supplier connection.
The ClickFix connection
ClickFix uses a fake repair or verification prompt to persuade someone to run a command on their own computer. Microsoft has documented fake document errors and human-verification pages that lead into these instructions. This exercise uses an invented supplier and invoice to explore those decisions.
Read the research: Microsoft: Think before you Click(Fix) (August 21, 2025). Source reviewed October 15, 2026.
A familiar name or page design does not establish that its instructions are authorized. Check unexpected requests through contacts or services you already trust.
Exercise limits
The dialogue, screens and outcomes are fictional. This is not a recreation of one incident. No executable commands are supplied, no clipboard content is read or written, and the story does not open operating-system dialogs or contact a supplier. The optional text reminder downloads only general guidance when you request it.
We have not lab-tested malware or recovery procedures. Completing the exercise does not establish staff readiness or verify the security of a device. How we prepare guidance
Already followed suspicious command instructions? Contact your agreed IT or security incident route promptly, using another trusted device when available. Follow their instructions. This exercise does not connect you to an incident responder.