ClickFix Analysis: How Fake CAPTCHA Pages Deliver Malware

ClickFix has become the dominant malware delivery technique of 2026, exploiting user trust in routine web verification. Attackers use fake CAPTCHA pages to trick victims into executing malicious commands, bypassing traditional defenses and leading to a massive surge in infostealer and RAT infections across both Windows and macOS platforms. Understanding how ClickFix attacks work and how to prevent them is now essential for any security team.

How This Was Researched

This analysis is based on published threat research from ReliaQuest, Rapid7, Microsoft Threat Intelligence, ESET via CSO Online, Infosecurity Magazine, and Huntress. The methodology involved synthesizing analyses of threat reports and vendor advisories published between Q1 and Q3 2026. We did not execute or test any ClickFix payloads — this analysis is based on published threat research only. Specific victim data and attribution to named threat actors are outside the scope of this research. Last researched: August 2026.

How ClickFix Attacks Work

ClickFix attacks manipulate users through fake human verification prompts on compromised websites. After landing on a malicious site, users see a counterfeit CAPTCHA or Cloudflare challenge. The page instructs them to press Win+R, paste a provided PowerShell command, and hit Enter to “verify” they are human. This user-initiated action downloads and executes malware in memory, leveraging the user’s own permissions and bypassing most endpoint controls.

The technique relies entirely on social engineering, not technical exploits. ReliaQuest’s March–May 2026 analysis identified ClickFix as the dominant malware delivery method during that period, surpassing phishing attachments and exploit kits. The attack chain begins with website compromise — Rapid7 documented 250+ compromised WordPress sites across 12 countries used to serve ClickFix payloads. These compromised sites include regional news outlets, local business websites, and even a US Senate candidate’s official page.

The social engineering is effective because it mimics legitimate troubleshooting workflows. Users are accustomed to copying and pasting commands from websites for software installs or browser fixes. The fake CAPTCHA exploits this familiarity — and because the user initiates the execution, antivirus tools categorize it as legitimate activity.

Why ClickFix Bypasses Traditional Security Tools

ClickFix bypasses endpoint protection because the user voluntarily executes the malicious command, making it appear as legitimate admin activity. The PowerShell script runs in-memory, evading file-based antivirus and EDR detections. The attack chain abuses built-in Windows binaries like PowerShell and the Run dialog, which are trusted by the system and rarely blocked.

Rapid7’s investigation into a DoubleDonut Loader campaign revealed the use of in-memory shellcode injection — the loader decrypts and executes payloads directly within legitimate Windows processes without writing to disk. Microsoft Threat Intelligence also observed variants using Win+X and Windows Terminal instead of Win+R to further blend in and evade detections targeting the Run dialog specifically. This user-authorized, living-off-the-land approach makes signature-based detection ineffective, requiring behavioral analysis to identify the malicious activity.

Traditional security tools also struggle because ClickFix campaigns use legitimate infrastructure. The compromised WordPress sites have valid SSL certificates and clean reputations. Web filters and reputation-based blocking tools cannot distinguish between a legitimate site and one serving ClickFix payloads without real-time content analysis.

The 517% Surge: ClickFix Campaign Scale in 2026

ClickFix-related techniques surged 517% year-over-year in 2026, according to ESET data cited by CSO Online. This explosive growth made ClickFix the number one malware delivery technique of 2026, displacing traditional phishing and exploit-based delivery.

The campaigns operate at massive scale. Rapid7’s report documented over 250 compromised WordPress sites across 12 countries in a single campaign, with new infostealers including Impure Stealer and VodkaStealer observed alongside well-known strains like Vidar Stealer, Lumma Stealer, and NetSupport RAT. Multiple ClickFix variants have emerged — CrashFix, ConsentFix, and PhantomCaptcha — each modifying the social engineering lure or execution chain to evade specific defenses.

The technique has expanded beyond Windows. Microsoft’s August 2026 analysis of a macOS ClickFix campaign showed attackers adapting the technique with platform-appropriate social engineering, shifting from openly serving lures to hiding them behind browser-fingerprinting gates. For broader context on how malware delivery is evolving, see our Dysphoria botnet analysis and malicious web bots analysis.

How to Prevent ClickFix Attacks

Effective prevention combines technical controls with user awareness. No single control stops all variants, but layered defenses significantly reduce risk by targeting both the social engineering component and the technical execution chain.

Restrict PowerShell execution. Enable Constrained Language Mode for standard users via Group Policy. Huntress identifies this as a primary chokepoint because most ClickFix payloads rely on PowerShell’s full capabilities.

Block Win+R and Win+X for non-admins. Use Group Policy to disable the Run dialog and restrict terminal shortcuts for standard users. This breaks the ClickFix execution chain at the user interaction point.

Deploy behavioral detection rules. Configure EDR to flag process chains where the Run dialog or Windows Terminal spawns PowerShell followed by outbound network connections within seconds. Huntress’s detection methodology focuses on these execution chokepoints rather than file hashes.

Train users to recognize fake CAPTCHAs. Legitimate CAPTCHAs never instruct users to open the Run dialog or paste commands. Users should report any page asking them to run PowerShell commands as part of verification.

Deploy web filtering with content analysis. Since compromised sites have legitimate reputations, use heuristics that inspect page content for fake CAPTCHA overlays rather than relying on blocklists alone.

For implementing defense-in-depth strategies, reference our security frameworks hub.

Detection Strategies for Security Teams

Map ClickFix to MITRE ATT&CK techniques to build effective detection coverage: T1059.001 (PowerShell), T1204 (User Execution), and T1218 (System Binary Proxy Execution). Detection rules should focus on the combination of these techniques rather than any single indicator.

SIEM correlation rules. Create alerts when a user session shows: Run dialog opened → PowerShell spawned → outbound network connection to a new domain within 30 seconds. Tune rules to exclude known administrative workflows.

JA3/JA4 TLS fingerprinting. Monitor TLS client fingerprints for connections from PowerShell contexts. Attackers’ C2 infrastructure often uses distinctive TLS configurations. ReliaQuest’s analysis identified TLS fingerprinting as effective for detecting ClickFix C2 traffic.

Clipboard-to-execution chain monitoring. ClickFix requires the user to copy a command from the browser and paste it into the Run dialog. Endpoint agents that monitor clipboard writes followed by PowerShell invocation within minutes can detect this specific chain. Cross-reference observed indicators against your vulnerability database to prioritize patching.

FAQ

What is a ClickFix attack?

A ClickFix attack is a social engineering technique where attackers compromise a website and display a fake CAPTCHA prompt. Users are tricked into pressing Win+R and pasting a PowerShell command that downloads and executes malware like infostealers or remote access trojans, as documented by ReliaQuest.

How do I know if I’ve been infected by ClickFix malware?

Watch for unexpected PowerShell windows, new background processes, unusual outbound network connections, and new scheduled tasks. Infostealers often target browsers and cryptocurrency wallets. Run a full EDR scan checking for in-memory artifacts — if you pasted a command after seeing a CAPTCHA prompt, treat the system as compromised.

Can ClickFix attacks target Mac users?

Yes. Microsoft Threat Intelligence documented a macOS ClickFix campaign in August 2026 that adapted the technique with browser-fingerprinting gates. Mac users should apply the same caution: legitimate CAPTCHAs never ask users to run terminal commands.