Executive Summary

ClickFix is a rapidly evolving social engineering technique that began gaining momentum in mid-2024. We have observed the exploitation of this social engineering tactic within multiple client environments as well as multiple threat intelligence sources. By camouflaging malware delivery within fake CAPTCHA verification screens or error messages, threat actors successfully lure end users into pressing Windows+R, pasting malicious code, and executing it, often without raising immediate suspicion. This method of tricking people into self-instigating the infection pathway sidesteps many traditional security controls. This advisory examines how ClickFix operates, documents active campaigns, and provides detection strategies and mitigation recommendations.

What is ClickFix?

ClickFix is a social engineering tactic that tricks users into executing malicious code through a series of deceptive prompts. The attack typically begins with the following sequence:

1. Initial Engagement

Users are presented with a fake CAPTCHA verification screen or error message when visiting compromised websites, clicking on malicious ads, or opening phishing attachments.

2. Social Engineering:

The fake verification page instructs the user to perform a specific sequence of actions:

• Press Windows+R to open the Run dialog
• Press Ctrl+V to paste content from clipboard (which contains malicious code secretly copied by the webpage)
• Press Enter to execute the command

3. Execution

The pasted command typically leverages Windows utilities like mshta.exe or PowerShell to download and execute additional malicious payloads.

Active ClickFix Campaigns

Several major malware families have been distributed through ClickFix campaigns. Lumma Stealer, a Malware-as-a-Service infostealer that emerged in 2022, has been widely deployed through these campaigns since December 2024. The Center for Internet Security (CIS) identified a campaign specifically targeting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations with Lumma Stealer. Other prominent malware distributed via ClickFix includes NetSupport RAT (documented by eSentire since January 2025), AsyncRAT, VenomRAT, DanaBot, XWorm, DarkGate, and various ransomware payloads. These malware families collectively provide attackers with capabilities ranging from credential theft and cryptocurrency wallet compromise to remote system control and data exfiltration.

In the past few months alone, various sources have reported widespread ClickFix abuse. Trustwave SpiderLabs observed multi-stage PowerShell execution processes with XOR encryption and AMSI bypasses to deliver multiple infostealer variants. FortiGuard Labs documented a phishing campaign using ClickFix to deploy a modified Havoc C2 Framework that leverages Microsoft Graph API to obscure communications. Sucuri research identified a massive WordPress-based campaign affecting over 5,200 websites, which used the Binance Smart Chain network to load malicious JavaScript that creates fake CAPTCHA screens. Researchers observed prominent threat group, Lazarus leveraging the ClickFix tactic to distribute FrostyFerret , GolangGhost, and other malware. Notably in Lazarus’s campaign curl was leveraged in place of mshta to deliver payloads. Microsoft Security researchers documented a campaign impersonating Booking.com that targeted the hospitality sector with multiple credential-stealing malware variants. According to Microsoft Threat Intelligence, these campaigns target individuals across multiple sectors, including hospitality, healthcare, banking, telecom, and marketing organizations in North America, Europe, Oceania, and parts of Asia.

Recommendations

Mitigations

Group Policy Object (GPO) Controls:

• Apply group policy restrictions that disable or restrict the usage of the Windows+R functionality, preventing users from easily accessing the Run dialog that ClickFix attacks rely on.
• Restrict WScript.exe and mshta.exe usage via AppLocker GPO or Windows Defender Application Control (WDAC).

Tools/EDR:

• Zero Trust Network Access (ZTNA) solution software such as Appgate SDP can be used if restricting the Windows Run dialog is not preferable. Such software can be configured and used as a “speedbump”, warning users of potential malicious Windows Run executions.

User Education:

• CAPTCHA Awareness: Educate users specifically about ClickFix tactics, emphasizing that legitimate CAPTCHA verifications never require executing Windows commands and that they should report suspicious verification prompts requesting Windows+R key combinations to security teams.
• Reporting Procedures: Establish clear procedures that encourage users to report suspicious websites or unusual CAPTCHA experiences.

Detection Opportunities

• Monitor for and consider blocking JavaScript or VBScript from launching downloaded executable content.
• Develop detection rules for process chains involving mshta.exe or PowerShell executing with encoded parameters, especially when following browser activity.
• Monitor for suspicious RunMRU registry entries containing PowerShell commands, particularly those with base64 encoding or invoking web requests.
• Consider implementing detections for AMSI bypass techniques, especially code patterns containing strings like “AMSI_RESULT_NOT_DETECTED,” which sources note is used by Lumma Stealer and other ClickFix-distributed malware.

Safeguards for SCALR XDR Customers

SRA’s Detection Engineering team is regularly adding new detections. This is intended to highlight potential safeguards observed in the common attack chain and may not be exhaustive of full protection.

SCALR XDR customers are protected by the following detection rules: