FixClick — ClickFix & Ghost Phishing Guard

Detects ClickFix paste-and-run lures and ghost/AiTM Microsoft token-phishing pages. Extensible detector framework.

A cross-browser Manifest V3 extension for Chrome, Edge, Brave, Opera and other Chromium browsers, plus Firefox, that detects two credential/token-theft attack families in the page, in real time, and warns the user: - ClickFix — fake "human verification" / error pages that trick you into pasting and running a command in the Windows Run dialog, PowerShell, or a terminal. Detected via clipboard interception + on-page lure heuristics. - Ghost phishing — Microsoft credential/token theft that appears to run on Microsoft's own infrastructure: - AiTM — a page rendering Microsoft's cloud sign-in form (the loginfmt username field) from a non-Microsoft origin (reverse-proxy kits such as Evilginx / EvilProxy). Keying on loginfmt avoids flagging legitimate on-prem AD FS pages and "Sign in with Microsoft" buttons, which don't render that field. - Device-code — the genuine device-authorization page, where an attacker relays a code for you to authorize their device. - Consent — an OAuth consent screen requesting high-risk Graph scopes and/or a non-Microsoft redirect.