The Lure Isn't The Malware. It's Your Logo.
ClickFix social engineering tricks victims into running OS-specific commands via fake CAPTCHA pages, bypassing traditional malware detection. ClickFix uses fake verification pages mimicking trusted brands to socially engineer victims into executing OS-specific commands on their own machines. Detection relies on identifying impersonation infrastructure rather than malware signatures.
Detection / Hunteropenrouter
Immediate Actions
- Block known ClickFix lookalike domains at web proxy
- Restrict execution of commands pasted from clipboard where EDR supports it
Key Takeaways
- ClickFix adapts instructions based on victim OS, offering different paths for Windows and macOS
- No exploit or automatic malware installation; the victim executes the payload manually
- Recorded Future's Malicious Site Monitoring uses layered signatures, content similarity, OCR, and ML to detect ClickFix pages
- Attackers reuse page templates across disposable domains, making content similarity analysis effective
- AI Triage Agent reviews flagged detections before alerts reach analyst queues
Attack Chain
- Initial Access: Victim visits a fake CAPTCHA or verification page impersonating a trusted brand
- Social Engineering: Page displays OS-specific instructions disguised as a verification fix
- Execution: Victim manually copies and runs the provided command on their machine
- Persistence: Attacker payload executes via victim-initiated command execution
Affected Systems
- Windows endpoints
- macOS endpoints
- Web browsers
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect command execution by users but may miss the social engineering entry vector. |
| Network Visibility | Medium | Network monitoring can identify connections to lookalike domains but not the payload delivery mechanism. |
| Detection Difficulty | Hard | Fake verification pages don't trigger traditional malware alerts; user-initiated execution blends with normal activity. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Users pasting and executing commands from clipboard content after visiting unfamiliar domains (T1204) | EDR process execution with clipboard paste patterns | Execution | Medium — users legitimately run copied commands |
| Lookalike domains serving CAPTCHA-like pages with OS-specific instructions (T1566.005) | Web proxy logs and DNS resolution data | Initial Access | Low — legitimate CAPTCHAs don't instruct command execution |
| Disposable domains sharing identical page templates across multiple registrations (T1584.001) | DNS registration data and web content similarity | Resource Development | Low — template reuse is uncommon for legitimate sites |
Required Log Sources
- Web proxy logs
- DNS logs
- EDR process execution logs
- Browser history
Key Behavioral Indicators
- Clipboard paste followed by immediate process creation in terminal
- User visiting lookalike domain before executing unusual commands
- Process ancestry showing browser-to-terminal execution chain
- Multiple disposable domains serving identical page templates
- CAPTCHA pages containing OS-specific command instructions
Control Gaps
- Traditional AV signatures cannot detect social engineering pages
- URL filtering may not catch newly registered disposable domains
- Browser security controls don't block user-initiated command execution
False Positive Assessment
Medium — legitimate verification pages and user-initiated commands are common, but CAPTCHA pages instructing command execution are rare.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable content similarity analysis on web proxy for lookalike domain detection
- Deploy DNS filtering for newly registered domains
User Protection
- Train users to recognize fake CAPTCHA pages that request command execution
- Disable clipboard-to-terminal auto-paste features where possible
Security Awareness
- Warn staff that legitimate CAPTCHAs never ask users to run commands
- Brief teams on ClickFix technique and OS-specific instruction variants
MITRE ATT&CK Mapping
Resource Development
Initial Access
Plain-Language Summary
Attackers create fake websites that look like familiar verification screens, such as CAPTCHA prompts, to trick people into running commands on their own computers. The attack works differently depending on whether the victim uses Windows or macOS. Recorded Future's monitoring tools detect these fake sites by analyzing page content, logos, and patterns across domains.