Loading story…
ClickFix (FakeCaptcha) campaigns are coercing Windows users into pasting attacker-supplied commands into the Run dialog, turning fake verification prompts into initial-access vectors. Recent activity has delivered the Node.js-based ChainScript RAT through msiexec.exe and Spotify-, Zoom-, or Teams-themed MSI installers; ChainScript persists via a scheduled task and Run key, uses Polygon smart contracts to discover WebSocket C2 servers, and supports shells, file operations, screen capture, wallet discovery, payload deployment, updates, and cleanup. A separate SmartApeSG-branded lure installed an unidentified RAT and persisted MeshAgent from %LocalAppData%\Temp% to connect with a malicious Mesh server.
Another ClickFix chain used caret-obfuscated Run-dialog commands, copied and renamed curl.exe, retrieved a purported PDF containing the legitimate IronPython 3.4.2 ZIP, and executed an in-memory Python payload through a renamed interpreter. The payload contacted artides[.]net with the K8VGmQTrzX User-Agent, disabled TLS certificate validation, then reportedly injected into a restarted explorer.exe and installed a low-level keyboard hook. Defenders should prioritize process-creation and RunMRU telemetry for explorer.exe spawning mshta.exe, cmd.exe, PowerShell, pwsh.exe, or conhost.exe, particularly with encoded commands, download cradles, clipboard activity, obfuscation, or unusual child processes; correlated DNS and mshta.exe detections improve resilience against easily changed lures and command strings.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Blackpoint Cyber’s Adversary Pursuit Group published analysis of ChainScript, a previously unreported Node.js RAT found during a ClickFix investigation. The malware used malicious MSI installers, scheduled-task or Run-key persistence, and Polygon smart-contract lookups to resolve rotating WebSocket C2 infrastructure.
A SmartApeSG-branded fake verification page used ClickFix instructions to infect Windows hosts with an unidentified RAT and MeshAgent. MeshAgent ran from AppData\Local\Temp, persisted on affected hosts, and communicated with a malicious Mesh C2 server.
A ChainScript-associated Polygon smart contract was deployed 23 seconds before creation of its corresponding MSI, ComponentTask33, suggesting an automated build pipeline for the malware infrastructure.
ShroudCloud published the stable, high-severity Sigma rule “FakeCaptcha Clipboard Injection via Explorer” for Windows process-creation telemetry. The rule detects Explorer-spawned interpreters and utilities with download, clipboard, encoded-command, and obfuscation indicators associated with ClickFix activity.
Proofpoint coined the name “ClickFix” for the FakeCaptcha-style social-engineering technique in which victims are instructed to paste malicious commands into the Windows Run dialog.
A ClickFix intrusion used a caret-obfuscated Run-dialog command to retrieve a batch script through finger.claudeam[.]com on TCP/79, download and disguise IronPython 3.4.2, and execute an in-memory Python payload from artides[.]net. About five minutes after initial execution, telemetry recorded injection into restarted explorer.exe and installation of a global low-level keyboard hook.
ShroudCloud detailed ClickFix/FakeCaptcha activity and proposed Sigma detections for suspicious DNS traffic, Explorer-spawned command interpreters, and anomalous mshta.exe behavior. The report also recommended layered detection and RunMRU telemetry for visibility into pasted Run-dialog commands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
meetcyber.net
Open sourcemalware-traffic-analysis.net
Open sourcecyberveille.ch
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and Microsoft documented multiple **ClickFix** intrusion chains that trick users into pasting malicious commands after fake browser errors or security prompts, then abuse native tools and staged scripting environments to deliver malware. In one Windows chain, a caret-obfuscated command entered through the Run dialog used the **finger** protocol over TCP/79 to fetch a batch stage, killed `explorer.exe`, copied and renamed the native `curl.exe`, downloaded the legitimate **IronPython 3.4.2** release from GitHub disguised as a PDF, extracted it with `tar.exe`, and launched an encoded Python payload. That payload decoded layered content, disabled TLS certificate verification, contacted `artides[.]net` for in-memory execution, beaconed to `claudeam[.]com`, and ended with **RemoteLibraryInjection** into `explorer.exe` plus installation of a global low-level keylogger. Microsoft separately described the **CrashFix** variant, which used a fake Chrome extension impersonating **uBlock Origin Lite** to establish foothold, intentionally crashed the browser, and then prompted victims to run commands that renamed `finger.exe` and fetched obfuscated PowerShell. On domain-joined systems, the activity dropped a portable **WinPython** environment and the **ModeloRAT** Python remote access trojan, established persistence through a Run key, and in related cases created a scheduled task named **`SoftwareProtection`** for repeated execution. Additional reporting showed the same broader ClickFix ecosystem targeting **Windows, macOS, and Linux**, including a Perl-based **Pearl Stealer** that harvested browser, wallet, document, and Apple Notes data, stole macOS passwords, and exfiltrated files after OS-specific clipboard-delivered commands downloaded payloads from attacker infrastructure.
Aug 14, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake **Intel Software Updater** Inno Setup package, unpacked a bundled **CPython 3.11** runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using **EtherHiding**. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into `ProgramData`, where `mod.pyc` decrypted its next stage with an inline **RC4** routine before moving toward process injection into `winver.exe` and a UAC elevation attempt involving **AppInfo** and `consent.exe`. The activity aligns with a broader malware-delivery ecosystem previously linked to **UNC5142**, which used EtherHiding-backed infrastructure and rapidly changing hosting on **Cloudflare Pages** (`pages.dev`), **Backblaze B2**, and domains such as `bluetroniq.vip` and `bytevista.cloud`. Observed lures frequently impersonated verification and security workflows, including fake **reCAPTCHA**, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as `/support`, `/win`, and `/start` indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
Jul 21, 2026