FixClick v1.1.0

1.1.0 — 2026-07-18

Added

• Trusted-sites allowlist (false-positive escape hatch). When a warning or the
  hard-block interstitial appears, you can click Trust this site to silence
  FixClick on that hostname. Trusted hosts produce no finding, no badge, and no
  overlay. The list is managed from the popup — a new Trusted sites section
  lists every trusted host with a per-host remove button, a Trust this site
  shortcut for the current tab, and Clear all.
• The allowlist is stored in local browser storage, so it is sticky across
  sessions and restarts but is cleared if you reset the browser's extension /
  site data. It never leaves your device.

Changed

• Fewer false positives on informational pages. The passive on-page ClickFix
  heuristic now requires all three signals together — fake "human verification"
  framing and a Run-dialog/terminal/paste instruction and actual
  command-shaped text — instead of accepting the framing or the command alone.
  Security articles, vendor blogs, and news write-ups that merely describe
  ClickFix (without carrying a live command payload) are no longer flagged. The
  behavioral clipboard-interception path — which fires when a page actually
  copies a command to your clipboard — is unchanged.

FixClick

A cross-browser Manifest V3 extension for Chrome, Edge, Brave, Opera and other Chromium browsers, plus Firefox, that detects two credential/token-theft attack families in the page, in real time, and warns the user:

• ClickFix — fake "human verification" / error pages that trick you into pasting and running a command in the Windows Run dialog, PowerShell, or a terminal. Detected via clipboard interception + on-page lure heuristics.
• Ghost phishing — Microsoft credential/token theft that appears to run on Microsoft's own infrastructure:
  • AiTM — a page rendering Microsoft's cloud sign-in form (the loginfmt username field) from a non-Microsoft origin (reverse-proxy kits such as Evilginx / EvilProxy). Keying on loginfmt avoids flagging legitimate on-prem AD FS pages and "Sign in with Microsoft" buttons, which don't render that field.
  • Device-code — the genuine device-authorization page, where an attacker relays a code for you to authorize their device.
    Consent — an OAuth consent screen requesting high-risk Graph scopes and/or a non-Microsoft redirect.

Heads Up!

• For ALL Chrome and Chromium based browsers use the chrome version.
• For ALL Firefox based browsers use the Firefox version.