The tale of ClickFix: 5 takeaways from RL’s new threat report

What Happened

A widespread attack method called ClickFix tricks people into copying and pasting hidden malicious commands into their computer's Run dialog or terminal by showing them a fake 'verify you are human' (CAPTCHA) page. Because the attack relies on the user voluntarily performing the action, it bypasses most security software — there is no exploit or malware file that triggers alarms. Criminals now sell ready-made ClickFix attack kits as a subscription service, and the types of malware delivered have expanded from password-stealing programs to remote access tools that can take over an entire network. The security company ReversingLabs has published a free detection rule that can identify these fake lure pages before any damage is done. Organizations should deploy this rule, train employees to recognize fake CAPTCHA prompts, and monitor for unusual use of built-in system tools like PowerShell.

Key Takeaways

• ClickFix uses fake CAPTCHA pages to trick users into pasting malicious commands into Run dialogs or terminals, executing payloads in memory without writing files to disk or triggering signatures.
• Traditional AV and EDR defenses are structurally blind to ClickFix because it relies on legitimate user actions and LOLBins (PowerShell, mshta.exe, curl, wscript.exe) that endpoint tools are programmed to trust.
• ClickFix MaaS kits are sold on underground forums for $250/month to $1,800 lifetime, lowering the barrier to entry and accelerating campaign volume without requiring attacker skill.
• Payload catalog has expanded beyond infostealers (Lumma Stealer) to include RATs (DarkGate, XWorm, AsyncRAT, NetSupport, SectopRAT), multi-stage loaders (GHOSTPULSE), and rootkits (modified r77), enabling full network compromise.
• RL released an open-source multi-condition YARA rule that detects ClickFix lures by requiring fake verification characteristics, PowerShell payload indicators, and active clipboard manipulation to appear together.

Affected Systems

• Windows endpoints with PowerShell, mshta.exe, curl, wscript.exe available
• Web browsers targeted by fake CAPTCHA lure pages
• Compromised legitimate websites used as watering holes (e.g., university website targeting students)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Victim visits compromised website or fake CAPTCHA page (watering hole or phishing link)
2. Reconnaissance: Operators profile victim using web analytics (Yandex Metrica), assign UUID, query blockchain smart contracts to check if already compromised
3. Social Engineering: Fake CAPTCHA page uses JavaScript to copy malicious command to victim's clipboard and instructs them to paste into Run dialog or terminal
4. Execution: Victim pastes command which invokes LOLBins (PowerShell, mshta.exe, curl, wscript.exe) to execute payload in memory without writing files to disk
5. Defense Evasion: Payload (e.g., zuhe.dll RAT) checks for 14 known sandbox environments before executing; infrastructure rotates aggressively including Ethereum smart contract C2
6. Persistence/Exfiltration: Payload (RAT, stealer, loader, or rootkit) establishes persistence, enables lateral movement, and exfiltrates data

Detection Availability

• YARA Rules: Yes
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: ReversingLabs Spectra Analyze, Open-source YARA rule from RL report

RL published an open-source multi-condition YARA rule that triggers only when fake verification characteristics, PowerShell payload indicators, and active clipboard manipulation appear together in HTML/JavaScript lure pages. The rule was validated against 422 billion goodware samples and identified 123 confirmed lures from 4,062 matches. It is deployable via Spectra Analyze for retro-hunting and active analysis.

Detection Engineering Assessment

Required Log Sources

• Process creation logs (Sysmon Event ID 1, Windows Security Event ID 4688)
• PowerShell script block logging (Event ID 4104)
• Clipboard activity monitoring
• Web proxy logs for fake CAPTCHA page access
• DNS resolution logs for C2 domains
• EDR telemetry for LOLBin execution with unusual parent processes

Hunting Hypotheses

Control Gaps

• Signature-based AV cannot detect ClickFix because no files are written to disk in a recognizable malware format
• EDR tools programmed to trust LOLBin execution by legitimate users will not flag PowerShell or mshta.exe invocations initiated via clipboard paste
• Domain- and hash-based detections age out quickly due to aggressive infrastructure rotation
• Blockchain-based C2 (Ethereum smart contracts) is invisible to network security monitoring tools
• Web content filtering may not inspect JavaScript for clipboard manipulation combined with fake verification text

Key Behavioral Indicators

• Browser process spawning PowerShell, mshta.exe, or wscript.exe shortly after page load
• JavaScript on web page combining navigator.clipboard.writeText with CAPTCHA/verification-themed DOM elements
• User pasting and executing commands from clipboard in Run dialog (rundll32.exe as parent)
• DLL loads or process behavior indicating sandbox environment enumeration before execution
• PowerShell execution with no script file on disk (inline/command-line execution from clipboard)
• Unusual curl downloads initiated from user sessions following web browsing activity

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing application control or allowlisting to restrict LOLBin execution (mshta.exe, wscript.exe) from user sessions where these tools are not required for business operations.
• Evaluate whether disabling or restricting PowerShell execution policy for non-administrative users is feasible in your environment.
• Consider monitoring DNS and web proxy logs for connections to newly registered domains or domains with short TTL records, as ClickFix campaigns rotate infrastructure aggressively.
• If your organization uses blockchain monitoring capabilities, consider evaluating whether Ethereum smart contract interactions from endpoint processes warrant investigation as potential C2 channels.

User Protection

• Consider deploying browser extensions or policies that restrict or warn on clipboard write operations initiated by untrusted web pages.
• Evaluate whether your endpoint protection can detect and alert on clipboard-to-Run-dialog or clipboard-to-terminal paste-and-execute sequences.
• Consider implementing application awareness training that specifically warns users about fake CAPTCHA pages instructing them to copy-paste commands.

Security Awareness

• Consider incorporating ClickFix-specific awareness content into existing security training programs, emphasizing that legitimate CAPTCHA pages never ask users to paste commands into Run dialogs or terminals.
• Consider adding ClickFix variant awareness (CrashFix, FileFix, PromptFix, ConsentFix) to phishing simulation exercises, as the technique family is actively evolving.
• Evaluate whether your current phishing reporting workflow encourages users to report suspicious CAPTCHA or verification pages, even if no traditional phishing email was involved.

MITRE ATT&CK Mapping

Additional IOCs

• Command Lines:
  • Purpose: Execute payload in memory via clipboard-pasted command from fake CAPTCHA page | Tools: PowerShell, mshta.exe, curl, wscript.exe | Stage: Execution | powershell.exe -