ClickFix, explained with a Romanian fairy tale: the attack where you run the malware yourself

Romania's National Cyber Security Directorate (DNSC) launched a campaign on 26 September 2026 called "Basme cu tâlc digital", fairy tales with a digital moral. The first one retells Ion Creangă's classic "The Bear Fooled by the Fox", and the attack it explains is ClickFix.

It is aimed at children. The trap works exactly the same on an adult at a work laptop, which is why it is worth a few minutes of any team's time.

The story in one line

In Creangă's tale the fox never attacks the bear. It convinces him to put his own tail through the ice to catch fish. DNSC's summary, as quoted by Mediafax: "The fox does not force the bear to put its tail in the hole. It convinces him it is the best choice."

ClickFix is the same move. The attacker does not break into the machine. They get the user to do the one step that compromises it.

How the trap works

1. A web page shows a message that looks like a normal system or browser notification.
2. It claims there is a technical error, an update to install, or that you must prove you are not a robot.
3. It asks you to copy some text and run it yourself, usually in the Windows Run box, in PowerShell, or in Terminal on macOS and Linux.
4. The text is a command that installs malware in the background. According to DNSC, that can give the attacker access to personal data, passwords and files.

It works because each step looks like routine troubleshooting, and the message adds urgency.

What DNSC recommends

• Do not run commands you do not recognise.
• Do not paste code into Terminal, PowerShell or Command Prompt unless you understand what it does.
• Treat any "urgent" or "mandatory" technical step with suspicion.
• Stop and ask for help before following instructions like these.

For a team, in one rule

If you look after other people's machines, the cheapest control is a sentence, written down and sent to everyone: nobody runs a command they got from a web page or a message, however official it looks. Add who to ask when it happens, so nobody feels they have to fix it alone.

In Romania, incidents are reported to DNSC at 1911 (24/7) or on the national platform PNRISC. DNSC notes that a PNRISC report does not replace a criminal complaint where one is needed.

The original article, in Romanian, with a section for public institutions: devaland.cloud. Sources: Mediafax and Go4IT on the DNSC campaign, checked 27 September 2026. The DNSC quote is translated from the Mediafax report.