Windows FileFix: paste-into-File-Explorer instructions (Win+E, Ctrl+L) — page content

Fake verification pages that copy a command to the clipboard and tell the visitor to open File Explorer (Win+E), select its address bar (Ctrl+L), paste with Ctrl+V and press Enter. Text pasted into the File Explorer address bar is run as a command, so this is ClickFix without the Run dialog (known as FileFix). First seen here on 2026-10-04 on a Russian-language fake reCAPTCHA ('document access confirmation') whose command downloads a PowerShell script, mounts a disk image named like a tax document and runs an executable behind a decoy PDF. The same File Explorer steps also appear as an option in a multi-language ClickFix kit injected into compromised websites. No legitimate verification step asks visitors to run a command.