Fake CAPTCHA (ClickFix) Social Engineering Used for Fileless Malware Delivery

Security researchers reported an active malware distribution technique that abuses bogus CAPTCHA pages to trick users into executing attacker-supplied commands on Windows. In the ClearFake campaign analyzed by Expel, victims land on a compromised site and are instructed to press Win + R, then paste and run a clipboard-seeded command—an approach commonly referred to as ClickFix—which results in malicious PowerShell execution. The campaign emphasizes living-off-the-land tradecraft and evasion, including proxy execution by abusing the trusted Windows script C:\Windows\System32\SyncAppvPublishingServer.vbs to launch PowerShell in hidden mode and reduce the chance of AV detection.

Separate measurement and telemetry on the same broader tactic found large-scale infrastructure supporting fake CAPTCHA lures: a Censys analysis identified 9,494 breached websites hosting counterfeit verification pages, with ~70% appearing nearly identical. The most common infection mechanisms involved clipboard manipulation leading to VBScript and PowerShell execution (with significant counts of each observed), alongside other delivery paths such as MSIEXEC-based installation of malicious Windows Installer packages. Researchers also observed use of the Matrix push command-and-control framework to support fileless deployment, noting that these intrusions can leave no traditional executable artifacts and may evade signature-based detection.