ToastFix Demo

This project demonstrates how convincing Windows toast notifications can be abused in social engineering attacks, specifically using ClickFix-style lures.

A live demo is available here (more realistic attack):
👉 https://h4lpy.github.io/

A detailed breakdown of the technique can be found in my Medium post:
👉 https://0xh4lpy.medium.com/toastfix-chaining-a-clickfix-attack-with-toast-notifications-72082694fef9

What happens?

1. The user is prompted to copy and run a PowerShell command
2. A realistic Windows toast notification is generated
3. Clicking the notification redirects to an explanation page

Example

How to run locally?

1. Clone the repository:

git clone https://github.com/h4lpy/toastfix-demo.git

2. Open index.html in your browser

3. Follow the on-screen instructions

Note: No server installation required - this demo runs entirely in the browser + PowerShell

Purpose

This project is intended for:

• Security awareness training
• Demonstrating social engineering techniques
• Red team / blue team / purple team education

PowerShell Script

The notification used in this demo is generated by a PowerShell script.

You can review or run it directly:

👉 toastfix-notification.ps1

This script only creates a local Windows toast notification and does not perform any malicious actions.

⚠️ Warning

This is a simulation designed for educational purposes only.

• No data is collected
• No persistence or malware is involved
• The PowerShell command only generates a local notification

Never run commands from untrusted sources in real-world scenarios.