A website asks the visitor to confirm that they are not a robot. As they read the instructions, the page secretly copies a command to the clipboard. It then instructs the visitor to open a terminal and paste it. The technique is called ClickFix, and it was the most common initial access method that the Microsoft team recorded last year. It accounted for 47% of the attacks included in its alerts.
In this case there is no attachment to scan and no vulnerability is exploited that needs to be fixed.
Something similar happens after the initial intrusion. In an analysis of 700.000 security incidents by Bitdefender, 84% of serious incidents involved executable files that were already on the computer. These are the same management tools that IT teams use every day. In many cases, the perpetrators didn’t have to install anything malicious because it simply wasn’t necessary.
Neither technique is particularly sophisticated. But both work because the perpetrators don't have to constantly search for new ideas. They look for processes that work the same way at the next company and the one after that.
Cybercrime operates with standardized procedures
A criminal group that has to devise a different method for each victim is unlikely to grow. In contrast, a group with specific steps that it can apply to a list of targets with predictable results can expand its activity as it finds new targets.
Verizon data shows this preference. The latest edition of its Data Breach Investigations Report identifies vulnerability exploitation as the dominant method of initial access, at 31%, up from 20% the previous year. That’s a 55% increase in one year, in a category where mass search for vulnerable systems is more important than technical originality.
Devices exposed to the internet are not chosen because they are of particular interest. They are chosen because the attack process is short and easily repeated:
- search for new CVEs on devices accessible from the internet,
- filtering those that allow remote code execution without authentication,
- waiting until a working proof of concept is published, usually on GitHub within a few days,
- massive scanning of the internet and attack on those systems that have not yet been updated.
In this process, the attackers do not need to develop their own tools. The exploit can come for free from a researcher and be published in a public repository. Thus, the attackers follow the pace set by someone else. The key skill required is the rapid execution of third-party code at scale.
This makes the exposure of a system online more important than the identity of the victim. The logic is reminiscent of a company producing generic drugs: it does not do the initial research, but waits for knowledge to become available and then mass-produces the same “prescription”, competing mainly on speed and cost.
The same picture is shown by ransomware activity. For more than a year, Qilin topped the leak site rankings, claiming to have had around 1.600 victims during that time, typically more than 100 per month. In June, The Gentlemen surpassed it, with 121 victims compared to Qilin's 80.
These numbers come from the groups themselves and have not been independently verified. However, they do show that the two groups are competing primarily on the pace and number of victims. These rankings measure how many organizations each group claims to have breached, not any technical feat.
The Gentlemen came from a former Qilin collaborator. As Bitdefender noted in its own threat update, this development shows that ransomware playbooks are recycled and improved. A process can be transferred from one organization to another and continue to operate without major changes.
This is probably the key asset of these groups: not an exploit, a tool, or some secret, but a method that can be recorded, handed down to others, and repeated.
Why ClickFix is so effective
The value of ClickFix becomes clearer if we view it as a ready-made playbook for initial access.
If defenses detect the method, there is no need to rebuild a payload, because there is no payload. If a vendor releases an update, there is no need to develop a new exploit, because no vulnerability is being used. If the bait message stops working, attackers can simply change the text of the web page.
The technique works the same way, regardless of the target's technological infrastructure. It relies on a human's willingness to follow instructions — a factor that exists in every environment and cannot be fixed with a patch.
The fact that it leaves few of the traces that defense teams typically look for, such as attachments, exploits, or recognizable signatures, is a significant advantage. However, the main reason is not necessarily to avoid detection. Attackers prefer it mainly because it can be repeated thousands of times, while the difficulty of detection is an additional benefit.
Using the tools already in the system
The same logic continues after initial access. For actions that lead to data theft or system encryption, perpetrators often use tools that are already installed on the computer.
Instead of carrying their own software, they leverage scripting engines, remote administration tools, compression programs, and other operating system tools. These accounted for 84% of Bitdefender’s analysis, as these executables appeared in the vast majority of serious incidents.
The main reason is not just concealment. These tools are familiar, exist almost everywhere, and — most importantly — work the same way in different environments. An operator who learns a sequence of actions can apply it to the next victim without significant adaptation. There is no need to port a tool to another platform or test it on an unknown system.
Similarly, the use of cloud services for command and control is common, as organizations already trust them and usually allow communication with them. The fact that the same tools resemble legitimate management is a significant added advantage. However, it is not necessarily the reason why they were chosen.
For defense teams, the problem is particularly difficult: when an attacker doesn't introduce anything new into the system, there is less material to detect.
More victims, less efficiency
If cybercrime is based on large-scale, repetitive processes, its economic picture should resemble a business pressured to reduce its cost per attempt. The available data shows just that.
Verizon's latest report shows a new surge in ransomware, now accounting for 48% of all breaches, up from 44% last year. During the same period, 69% of ransomware victims did not pay the ransom, while the median amount for those who did pay fell to $139.875, down from $150.000.
Bitdefender also recorded 704 organizations reported as victims of leak sites in June 2026 alone.
More victims, but less money per incident, means less return per effort. The logical response to such pressure is not to make every attack more sophisticated. It is to make it cheaper, more repeatable, and more often executed.
This is where the AI debate meets economics. The playbook approach has a very low cost per attempt: the scan is cheap, the exploit may have been published for free, and the tools are already on the victim's computer.
Adding an AI model to every attack increases the cost of an activity that has been trying to reduce it to near zero for years. It may make sense when the target is a few high-value organizations, but not when the list includes thousands of small businesses.
Why full autonomy is not yet the obvious choice
An autonomous agent explores the environment, finds a path, and adapts to what it finds. This path is different in each organization. If it were to run in the next company, it would likely behave differently.
This is impressive from a technical perspective, but it goes against the logic of a playbook. Ransomware often operates on an affiliate model, where the process must be stable enough that it can be given to different operators and produce a similar result.
Variability makes it difficult to document, educate affiliates, and predict behavior toward an unknown victim. A tool that solves every problem differently doesn't fit easily into a business that relies on doing the same thing every time.
There is, of course, a logical use of AI by perpetrators: a model could be used offline to research a technique, build tools, or refine a bait message. The result could then be incorporated into a consistent process. In this case, the AI acts as a playbook creator rather than an executor improvising live on each victim.
The same goes for the idea that AI will enable the discovery of original vulnerabilities. Teams already shy away from investing in this process because they can wait for someone else to find the vulnerability and publish the proof of concept for free. To change this balance, AI discovery would have to cost less than waiting — something that is difficult when waiting costs next to nothing.
This doesn’t mean that the situation will remain the same forever. Attackers quickly adopted ransomware-as-a-service and double extortion when they made business sense. They will do the same with autonomy when the cost of using a model becomes less than the cost of the existing process.
Where should defenses focus?
The upside is that a standardized attack also creates a more specific defense problem. Organizations don't need to protect themselves from unlimited creativity, but rather close the key entry points on which the playbook depends.
- Smart prioritization of updates. It is not always possible to patch all systems at once. The same logic used by attackers can help defense teams: internet-facing devices, remote code execution capability, and no authentication requirements are key indicators of priority. The critical time window is often the period from the publication of the advisory to the appearance of a working proof of concept on GitHub, which can be as short as a few days.
- Limiting the software and scripts that can be executed. Application control and script execution policies can interrupt the ClickFix chain, at the point where the pasted command becomes an active process.
- Checking the built-in tools. Most users do not need remote administration tools and scripting utilities. These may not be removed from the system, but the organization can decide which users and which applications have permission to run them.
- Identity as a real security limit. Shared logins, overly powerful service accounts, and keys with admin privileges everywhere can turn a compromised computer into a wider incident.
- Correlation of events. An attack based on system tools may not seem suspicious when viewed in isolation. Running a remote administration tool may be normal. The same goes for logging in to an account or communicating a computer with cloud storage. What is suspicious is the combination of them, when they occur in this order, on the same computer, and at an unusual time.
- Monitoring notifications. According to research by Bitdefender’s incident response and MDR teams, two problems come up: either endpoint detection is not installed, or it is installed but no one is monitoring the alerts. There is a third, equally problematic case: the tool works and generates an alert, but it does not reach anyone with the authority to stop the attack. A detection that is not monitored is not a meaningful defense; it is simply a log to be read later.
Perpetrators aren't necessarily looking for the most impressive technology. They're looking for something reliable, that can be used by anyone on the team, works in different environments, and produces the same result over and over again.
That’s exactly what ClickFix and the use of tools already in the system offer. Whatever use AI eventually finds, it will likely be adopted when it becomes cheaper than the processes that already deliver. Until then, the key entry points through which attacks pass are specific — and can be closed.
Your comments will not be published if: