Universities and colleges warned of evolving ClickFix cyber threat

In our quarterly briefing coinciding with cyber security month, we briefed cyber professionals on the latest threats detected by our security operations centre and cyber security incident response team.

Our experts described how ClickFix scams give users instructions to ‘fix’ their computers or verify they are human. By following instructions to copy, paste and run commands, users are tricked into running malicious applications that give access to an organisation’s network.

These scams have now been found to use blockchain smart contracts to store their malicious payloads rather than being held on an attacker’s own servers, making it harder to detect attacks and their point of origin.

ClickFix scams rely on convincing users to follow instructions through sophisticated and convincing phishing emails. Monthly cyber security reports showed that we blocked between 300 and 37,000 phishing attacks per week against universities, colleges and research bodies in the first two months of the 2026/27 academic year.

However, ClickFix attacks have evolved to exploit the WebRTC standard that enables browser-based video calls and peer-to-peer data transfers. By inserting their fake instructions into the process of connecting users these attacks can by-pass users’ scepticism of traditional phishing emails.

Nicole Stewart, our head of security intelligence and capability, said:

“Cyber criminals are constantly innovating new ways to gain access to networks. All organisations should ensure that employees and students are aware of ClickFix scams, and that no legitimate CAPTCHA or verification check will ask users to copy, paste and run commands.”

The briefing concluded with a presentation from the National Centre for Cyber Security (NCSC) confirming that education is one of the most targeted sectors for cyber crime in the UK.

The NCSC spokesperson described the intellectual property (IP) held by UK researchers as “a critical component of economic growth” and therefore a target of cyber espionage by competitor countries.

Meanwhile sensitive data combined with the wide range of systems used by universities make the sector a tempting target for criminal ransomware attackers.

How we can help

Our members benefit from a baseline of security provided by the Janet education and research network including DDoS mitigation, protective DNS and incident support.

To receive quarterly briefings and monthly threat reports, our members and customers can join our cyber security community group.