ClickFix social engineering tricks users into pasting malicious commands from fake error or CAPTCHA pages into OS tools, enabling malware deployment by STARDUST CHOLLIMA and VOODOO BEAR. ClickFix is a social engineering technique where adversaries present fake errors or CAPTCHAs on compromised or attacker-controlled websites, instructing users to copy and paste malicious commands into trusted OS utilities. Execution triggers PowerShell or VBScript chains that download additional payloads, enabling credential theft, persistence, and C2. CrowdStrike attributes campaigns to STARDUST CHOLLIMA and VOODOO BEAR, with a 563% increase in fake CAPTCHA incidents reported in 2025.
Fake CAPTCHA
3 posts
Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT A recent phishing campaign impersonates Amazon security alerts to deliver a custom remote access trojan (RAT) dubbed HarborWatch Agent. The attack leverages the ClickFix technique, using a fake CAPTCHA page to socially engineer victims into manually executing a malicious PowerShell command via the Windows Run dialog. Once executed, the script downloads the RAT, which collects system information and communicates with a C2 infrastructure managed via a panel called Harbor Sentinel.
Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs Threat actors are utilizing Traffic Distribution Systems (TDS) to direct mobile users to fake CAPTCHA pages that trick them into sending premium international SMS messages. This International Revenue Share Fraud (IRSF) scheme leverages social engineering and back button hijacking to generate multiple SMS messages per victim, resulting in significant financial charges.