Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them
ClickFix social engineering tricks users into pasting malicious commands from fake error or CAPTCHA pages into OS tools, enabling malware deployment by STARDUST CHOLLIMA and VOODOO BEAR. ClickFix is a social engineering technique where adversaries present fake errors or CAPTCHAs on compromised or attacker-controlled websites, instructing users to copy and paste malicious commands into trusted OS utilities. Execution triggers PowerShell or VBScript chains that download additional payloads, enabling credential theft, persistence, and C2. CrowdStrike attributes campaigns to STARDUST CHOLLIMA and VOODOO BEAR, with a 563% increase in fake CAPTCHA incidents reported in 2025.
Detection / Hunteropenrouter
Immediate Actions
- Block PowerShell and VBScript execution for non-admin users where feasible
- Deploy browser security controls that detect clipboard injection from web pages
- Hunt for PowerShell or VBScript execution originating from interactive user sessions
Key Takeaways
- CrowdStrike reported a 563% increase in fake CAPTCHA lure incidents in 2025.
- STARDUST CHOLLIMA deployed previously unknown GeniexLoader and GeniexRAT via fake meeting lures in July 2026.
- VOODOO BEAR compromised Ukrainian websites to serve fake CAPTCHAs targeting Ukrainian employees in France, US, and Canada.
- Some ClickFix variants use JavaScript to place malicious commands directly onto the clipboard.
- ClickFix evades file-based security tools by relying on legitimate OS interpreters like PowerShell and VBScript.
Attack Chain
- Initial Access: Victim visits compromised or attacker-controlled site displaying fake error, CAPTCHA, or meeting issue
- Social Engineering: Page instructs user to copy a command; JavaScript may auto-place it on clipboard
- Execution: User pastes command into Windows Run, PowerShell, or Terminal, triggering interpreter execution
- Payload Download: PowerShell or VBScript retrieves and executes additional malware payloads
- Post-Compromise: Deployed malware enables credential theft, persistence, C2, and data exfiltration
Affected Systems
- Windows endpoints with PowerShell and VBScript enabled
- Web browsers used to access compromised or attacker-controlled sites
- Employees targeted via fake meeting or CAPTCHA lures
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | PowerShell and VBScript execution from user-initiated paste is visible to EDR via process telemetry. |
| Network Visibility | Medium | Initial browser interaction is visible; payload download over HTTPS may be encrypted and blended. |
| Detection Difficulty | Moderate | Behavioral detection of user-pasted commands is feasible but requires correlating browser activity with process execution. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Browser process followed by PowerShell or VBScript execution with clipboard-pasted content originating from a web session (T1059.001, T1204.002) | Process ancestry and command-line logs | Execution | Medium — legitimate admin tasks may match pattern |
| VBScript payload downloaded and executed after PowerShell initiation from a user-interactive session (T1059.005, T1105) | Process creation and network connection logs | Defense Evasion | Low — uncommon in normal enterprise use |
Required Log Sources
- Process creation events (Sysmon EID 1)
- PowerShell script block logging (EID 4104)
- Command-line auditing events
- Browser web request logs
- DNS resolution logs
Key Behavioral Indicators
- PowerShell or VBScript spawned shortly after browser session with no prior file download
- Clipboard content pasted into Run dialog or terminal originating from web page
- VBScript execution initiated by user-interactive PowerShell without admin context
- Process chain: browser → user-initiated interpreter → network download of script payload
Control Gaps
- File-based AV cannot detect user-pasted commands executed by legitimate interpreters
- Network-only controls miss the browser-to-endpoint transition
- Browser isolation may not prevent clipboard copy of malicious commands
False Positive Assessment
Medium — legitimate IT support workflows may involve pasting commands from web pages, requiring behavioral context to distinguish.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict outbound network connections from PowerShell and VBScript processes
- Enable PowerShell Constrained Language Mode for non-admin users
- Deploy browser extension or enterprise browser to block malicious clipboard writes
User Protection
- Train employees never to paste commands from websites into OS tools
- Display warning banners in browsers when clipboard content is modified by JavaScript
- Disable JavaScript clipboard API on untrusted sites via browser policy
Security Awareness
- Educate staff that legitimate meeting platforms never ask users to paste commands into Run or Terminal
- Include ClickFix scenarios in phishing simulation exercises
- Distribute guidance on recognizing fake CAPTCHA and error page lures
MITRE ATT&CK Mapping
Initial Access
Persistence
Command and Control
Plain-Language Summary
Attackers create fake error messages or CAPTCHA prompts on websites that tell users to copy a command and paste it into their computer's built-in tools. When users follow the instructions, the command runs malicious software that can steal data or take over the computer. Two attacker groups used this method in 2026, targeting employees at financial firms and Ukrainian organizations. Organizations should train staff never to paste commands from websites and use browser and endpoint security tools that detect this behavior.