ClickFix Attacks: How to Detect and Investigate Fake CAPTCHA Lures

ClickFix has become one of the most common ways attackers gain initial access. In one vendor's threat telemetry it ranked as the second most common attack vector, behind only phishing, and it works across Windows and macOS even where EDR is deployed.

The six campaigns below, all recently and independently reported, show how little the technique's core changes as the payload does. They range from ransomware and credential stealers on Windows to wallet drainers on macOS, and in every one the initial access step is identical: a site tricks the user into copying a command and running it on their own machine.

These six campaigns share almost no file signatures, and their lure pages use short-lived domains that disappear in a day or two. What they do share is the hand-off: a malicious string copied from the browser and executed by an interpreter the user launched by hand. Attackers cannot remove this hand-off without abandoning the technique, and the step leaves behind useful endpoint telemetry used for investigations.

What a ClickFix attack does to the endpoint

A ClickFix attack is a social-engineering technique where a web page tricks a user into copying a command and running it themselves, typically in the Windows Run dialog or macOS Terminal. Because the malicious code is typed or pasted directly by the user, it bypasses email filters and browser sandboxes that focus on downloaded files.

MITRE catalogs the technique as T1204.004, User Execution: Malicious Copy and Paste, covering Windows, macOS, and Linux. ATT&CK is clear about why it works: tricking users into executing commands manually bypasses the primary defensive controls designed to block malicious file downloads.

No software vulnerability is exploited, no attachment is opened, and no executable file crosses an email or web gateway. Security controls traditionally focus on incoming files, but ClickFix arrives as raw keystrokes. Microsoft's Defender Experts team has reported seeing thousands of devices affected by a ClickFix attack per month, with EDR deployed.

Prophet Security has observed this pattern firsthand. During a red team engagement in a client environment, operators gained access through a ClickFix lure. The pasted payload dropped a DLL that hooked into excel.exe upon launch, creating a command-and-control channel that blended into ordinary Microsoft Office process behavior. Nothing in the chain was flagged as traditional malware; it appeared as a user fixing an issue followed by normal network activity from Excel. Uncovering it required correlating evidence across sources rather than relying on a single alert.

Six campaigns, one delivery method

• StopAndProtect (Check Point Research): Injected fake verification overlays into roughly 2,000 compromised WordPress sites. The pasted command launched a hidden PowerShell process that bypassed execution policies, downloaded .NET payloads, and deployed a six-module toolkit (file encryption, credential and file collection, an SMB and USB scanner, a WMI-based VBS spreader, a lock screen, and an operator chat proxy). Check Point tracked over 6,000 victim IP addresses.
• PavinLoader (Malwarebytes): Used a fake Cloudflare verification page directing users to run a command in the Windows Run dialog. Its execution chain is distinct and highly detectable: MSBuild.exe running .csproj files with inline UsingTask elements, the environment variable MSBUILDENABLEALLPROPERTYFUNCTIONS set to 1, and conhost.exe running in headless mode. It resolved its command-and-control server through the BNB Smart Chain before loading Amatera Stealer in memory.
• Interlock (Sekoia, The DFIR Report, Proofpoint): Sekoia documented the ClickFix delivery, including a specific wrapper, cmd /c start /min powershell with the abbreviated hidden window-style flag, followed by opening a decoy page to microsoft.com so the victim assumed the verification succeeded. The DFIR Report and Proofpoint documented a later variant that deleted a scheduled task named Updater and ran a PHP interpreter from the user's roaming profile. CISA, the FBI, HHS, and MS-ISAC named this vector in advisory AA25-203A, which makes Interlock the campaign with the longest documented run on the technique.
• Cloaked macOS gates (Microsoft Threat Intelligence): Fingerprinted the visiting browser down to the WebGL GPU string and served the lure only to genuine Apple hardware, returning blank pages or decoy content to everything else, across more than 250 front-end domains.
• A Go-based macOS stealer (Huntress): The pasted one-liner finished by clearing the terminal scrollback and deleting its own shell-history entry, then registered a LaunchAgent named to impersonate Apple's software-update daemon.
• MacSync (Huntress): Spread through a counterfeit Claude installation guide hosted as a shared conversation page on the real claude.ai domain, under the fabricated author name "Apple Support". It pulled the Chrome Safe Storage key with the security command to decrypt saved logins.

Across all six campaigns, the required user action remained identical. This is why investigations such as phishing investigation and MFA fatigue triage both start by reconstructing user actions rather than by evaluating isolated file artifacts.

The Windows chain: explorer.exe, RunMRU, and the interpreter

On Windows, the Run dialog runs as a child process of explorer.exe, meaning any interpreter launched from it inherits explorer.exe as its parent. This relationship forms the core of most detection logic. Red Canary publishes an analytic keyed on just two conditions, mshta.exe executing with an http or https string in its command line, and calls it one of its easiest and highest-converting detection rules.

The most durable forensic artifact is in the Windows Registry. Commands entered into the Run dialog are recorded under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU as single-letter values, with the execution order tracked in the MRUList value. Four details govern how to investigate this key:

• Verbatim string storage. RunMRU stores the exact payload placed on the clipboard before any downstream deobfuscation occurs, which is the closest thing available to a transcript of the social-engineering step.
• Backslash-1 terminators. Stored values end with a literal backslash-1, so entries look like notepad\1 or mshta.exe\1. Detection exclusions have to account for the suffix, which is why Microsoft's own hunting query excludes mshta.exe\1 and mshta\1 rather than mshta. Ordering is carried by MRUList, not by that terminator, although at least one vendor describes the terminator differently.
• Single key timestamp. The registry tracks only the last-write timestamp for the parent key, not individual entries. Pivot from process-creation events to the registry write, not the other way around.
• Failed executions leave no artifact. Microsoft notes that Windows writes no registry entry if the command fails to launch. An absent RunMRU value on a host with a confirmed execution chain is therefore a finding rather than a contradiction: the command may have failed, the key may have been cleared, or the paste may have landed somewhere else entirely. Attackers do delete the key deliberately, which is why SigmaHQ ships two rules for that deletion.

Because the Run dialog caps inputs near the Windows path size limit, a practical ceiling of around 259 characters, attackers use short downloaders rather than full scripts. Microsoft also observed that Windows Terminal's multi-line paste warning deterred victims and pushed operators back toward the Run dialog, which is what makes RunMRU the highest-yield Windows artifact for this technique.

Detection rules that rely solely on specific keywords quickly become outdated. SigmaHQ's rule looks for a URL paired with a lure word such as verification or captcha, while Elastic's rule hard-codes a homoglyph spelling of "human validation." Both work at first, and both key on strings the operator chooses, so an attacker gets past them by tweaking the phrasing. When that happens, the strict rules miss the attack entirely, while the broad rules fire so many low-severity alerts that they get ignored.

To cut through the noise, threat hunters key on command length instead of specific words. Because observed ClickFix commands average around 179 characters, a CrowdStrike hunting lead and an independent analysis both filter for values over 50 characters, which is far more durable. Even then, a single registry entry does not tell you much on its own. To make a clear call you connect that initial hit to the EDR alerts that fire right behind it, then use the EDR tool's own data collection to investigate further, checking the RunMRU values in the registry, for example.

FileFix, TerminalFix, and variants that bypass Run dialog rules

Rules expecting explorer.exe as the parent process only catch one specific execution path. Attackers regularly shift the paste target, altering both the parent process and the resulting artifact.

FileFix, published by the researcher mr.d0x, tricks users into pasting commands into the File Explorer address bar opened by an HTML file-upload prompt. The real command sits in front and the plausible document path sits behind a # symbol, so the shell treats the path as a comment. Because that window belongs to the browser, both the parent process and the registry artifact change.

{{ebook-cta}}

The macOS chain: Terminal, Script Editor, and quarantine removal

While macOS lacks a Run dialog and a registry, the core behavior remains identical: a user pastes a command into an application, triggering an interpreter that downloads a payload. ATT&CK's own detection strategy for T1204.004 specifies that chain for macOS, keying on Terminal or iTerm2 as the parent of zsh, bash or python with a download-and-decode command line, followed by file creation under /tmp or the user's Library directory and outbound egress.

Four recurring macOS behaviors warrant dedicated detection logic:

• Fake password prompts. All three campaigns use osascript to generate a native-looking password dialog. Where the validation step is documented, the entered password is checked locally with dscl in authonly mode, which avoids standard authentication logging. Legitimate software rarely calls dscl that way, so the evasion is itself the signal.
• Quarantine bypass sequence. Stripping the quarantine attribute with xattr, followed within seconds by chmod +x on the same path. Microsoft names both utilities in its guidance for this campaign family.
• Shell-based Keychain access. Running security find-generic-password from a shell script rather than a signed application, to extract browser storage keys and decrypt saved credentials.
• Persistence via LaunchAgents. Creating plists in the user's LaunchAgents directory with launchctl or PlistBuddy, usually named to impersonate a legitimate system update service. The impersonation is the point, so hunt the writing process rather than the plist label.

When Apple added multi-line paste warnings to Terminal in macOS 26.4, attackers adapted by routing execution through Script Editor using the applescript URL scheme, which Jamf documented delivering Atomic Stealer. Because legitimate administrative activity rarely involves Script Editor spawning curl or a shell, detections should target Script Editor process execution directly rather than relying solely on Terminal.app parentage.

Where current detection logic falls short

Public detection repositories for ClickFix are better stocked than most, and they still leave three coverage gaps.

• Heavy keyword reliance. High-severity rules depend on specific strings: a lure noun, a check-mark emoji, Unicode padding, or the # comment marker. Attackers strip those words and keep the command short, so the high-severity rules stay silent while the broad rules generate more volume than anyone can work by hand. Rather than tuning the noisy rule out of existence, route it into automated investigation, so the volume gets triaged instead of ignored.
• Unmapped legitimate activity. Remote support and help-desk workflows mirror ClickFix behavior closely. A technician guiding a user to press Win+R and run a command generates identical registry and process telemetry. Vendor guidance names admin maintenance, deployment tooling, package managers such as Homebrew and rustup, and phishing-simulation programs as false-positive classes, but no published rule treats remote support as one. Separating them needs session context, whether a screen-share or RMM agent was active at that moment, plus the reputation of the fetched URL. No published rule evaluates either.
• The telemetry gap at the hand-off. Detections trigger only after the command executes in explorer.exe or an interpreter. The seconds or minutes between the browser writing the clipboard and the user pasting into the Run dialog are not correlated by any published logic, even though ATT&CK describes that sequence in prose. The consequence is measurable: ReversingLabs matched 283 lure pages with a single YARA rule and found that more than 60 percent had no antivirus detection at the time of analysis.

Addressing these gaps means treating ClickFix as a multi-stage correlation problem across endpoint, browser, and network telemetry rather than a signature match, which puts it in the overlap between detection and investigation. The rule tells you a string was pasted; deciding whether the events around it describe an intrusion is a separate piece of work, and it is the piece that does not scale with headcount.

Investigating ClickFix attacks with Prophet AI

To a security operations center, a ClickFix attack initially looks like four unrelated, low-severity events: a registry write, an interpreter launching hidden, a connection to a newly registered domain, and a new plist file in a user directory. Each has a benign explanation available, and it is the order they arrive in that identifies the intrusion.

Prophet AI SOC Analyst does that correlation on every alert rather than on the ones that survive a queue. It maps the process ancestry, resolves the domain reputation, checks the pasted string against known lure families, and documents every query so an analyst can copy it and run it themselves. When the evidence is inconclusive, it says so instead of guessing.

For the technique-level question, whether this campaign already ran somewhere in the estate, Prophet AI Threat Hunter ships curated hunts for newly disclosed lures and techniques that your team runs or schedules on its own terms. What those hunts confirm becomes a candidate detection through the AI Detection Engineer, backtested against your own history before anyone approves it.

Lure domains are replaced in a day or two, so the delivery infrastructure is usually gone before anyone goes looking for it. The process ancestry and the registry artifacts are still on the endpoints that ran them. Request a walkthrough to see what a full investigation of one of these chains looks like against your own telemetry.