ClickFix / KongTuke Clipboard-Hijacking Social-Engineering Technique (MITRE T1204.004) — Fake-CAPTCHA Lures Delivering Infostealers, RATs, and Ransomware

ClickFix / KongTuke Clipboard-Hijacking Social-Engineering (TL-2026-1130), also tracked as ClickFix, is a high-severity tracked intrusion set, first published 2026-07-05. It is attributed to KongTuke with medium confidence, affects Microsoft Windows (Run dialog / PowerShell / cmd.exe execution, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1130

Threat ID
TL-2026-1130
Also known as
ClickFix, Paste-and-Run, Fake-CAPTCHA Attack, FileFix, TerminalFix, DownloadFix
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-07-05
Last reviewed
2026-07-05
Attribution
KongTuke
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
education, technology, government administration, health, finance
Target regions
Global, North America, Europe
Detection rules
9
Indicators of compromise
27

Malware and tooling in ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

Malware and tooling: 8base, AMOS, Akira, AlphV/BlackCat, DarkGate - S1111, Epsilon Red, Latrodectus - S1160, Lumma Stealer - S1213, MintsLoader, interlock, modeloRAT, rhysida

Independent verification of IOCs cited in a Tier-1 SOC triage methodology article (cybersecuritynews.com) found that the example domain dntds.shop and associated IP 89.190.158.132 are genuinely tracked ClickFix ('paste-and-run' fake-CAPTCHA) malware-delivery infrastructure, corroborated by ANY.RUN sandbox reports, ThreatFox, Gridinsoft, and urlscan.io. ClickFix (MITRE ATT&CK T1204.004, added March 2025) tricks users into copying and pasting an attacker-controlled clipboard payload into the Windows Run dialog, PowerShell, or macOS Terminal, leading to infostealer, RAT, and ransomware-affiliate infections; it is separately weaponized at scale by the KongTuke compromised-WordPress/TDS cluster and by nation-state actors (APT28, MuddyWater).

How ClickFix / KongTuke Clipboard-Hijacking Social-Engineering works

The originating source article (cybersecuritynews.com, sponsored by ANY.RUN) is a general Tier-1 SOC alert-triage methodology piece that uses three example indicators — IP 107.170.45.91 and domains dntds.shop and fourdigs.cyou — purely to illustrate an IOC-enrichment workflow, with no campaign attribution given in-article. The HUNT phase correctly flagged this as containing no reportable threat on its face. However, RESEARCH-phase independent pivoting on the cited indicators found that one of them, dntds.shop, is NOT merely illustrative: it is an actively tracked malicious domain. ANY.RUN interactive sandbox analysis rendered a 'malicious activity' verdict against dntds.shop across at least two independent submissions, ThreatFox (abuse.ch, IOC #1780849) tags it 'clickfix' and 'phishing', Gridinsoft assigns it a 1/100 trust score with 19 blacklist detections and phishing-signal flags, and urlscan.io holds a recorded scan of the domain. ANY.RUN's own May-2026 technical write-up on the ClickFix technique separately documents 89.190.158.132 as a destination IP observed during ClickFix sandbox detonations, corroborating that this infrastructure participates in the live ClickFix ecosystem rather than being a random illustrative artifact. The other two indicators from the source article — fourdigs.cyou and 107.170.45.91 — could NOT be independently corroborated as malicious via WebSearch, ThreatFox, or reputation-service lookups at the time of this research; they are retained below as low-confidence/unconfirmed IOCs for completeness and future re-checking, and are NOT treated as confirmed threat infrastructure.

ClickFix (aka 'paste-and-run', 'fake-CAPTCHA', formally MITRE ATT&CK sub-technique T1204.004 'User Execution: Malicious Copy and Paste', added to Enterprise ATT&CK in March 2025) is a clipboard-hijacking social-engineering technique first documented in the wild in March 2024 and now one of the most prevalent initial-execution vectors tracked by the industry (Huntress reported a 631% increase in ClickFix-related incidents between August 2024 and August 2025). Victims land on a page (via phishing link/attachment, malvertising, SEO poisoning, or a compromised legitimate website) that displays a fake reCAPTCHA/Cloudflare Turnstile check, a fake Windows/browser error, or a fake 'verify you are human' prompt. JavaScript on the page silently writes an obfuscated command to the clipboard via the clipboard API; the victim is instructed to press Win+R (or open PowerShell/Terminal on macOS), paste (Ctrl+V), and press Enter, personally executing the attacker's first-stage payload. First-stage payloads are typically short PowerShell one-liners, mshta.exe/rundll32.exe/msbuild.exe/regasm.exe LOLBin invocations, or curl/wget downloaders that retrieve an obfuscated second-stage script, which in turn fetches the final payload — commonly infostealers (Lumma Stealer/LummaC2, Atomic macOS Stealer), loaders (DarkGate, Latrodectus, MintsLoader, Emmenhtal), RATs (AsyncRAT, NetSupport RAT, SectopRAT, Xworm, Quasar RAT, Interlock RAT, modeloRAT), or, via affiliate hand-off, ransomware (Epsilon Red; and via the KongTuke cluster, Rhysida, Interlock, 8Base, Akira, and AlphV/BlackCat).

A distinct, separately-documented ClickFix delivery cluster tracked by Trend Micro under the name 'KongTuke' compromises WordPress sites at scale (300+ sites and 40+ traffic-distribution-system domains observed), injecting malicious JavaScript (e.g., served from foodgefy.com / 162.33.178.171) that redirects visitors into fake-CAPTCHA ClickFix pages. KongTuke's chain has been observed delivering the Python-based modeloRAT and ultimately handing off infected hosts to multiple ransomware affiliate groups. Domains nitzschi.com and windlrr.com are separately tagged to the KongTuke cluster on ThreatFox. ClickFix has also been weaponized by nation-state actors independent of KongTuke or the dntds.shop cluster: Group-IB documents APT28 using ClickFix against Ukrainian government targets and MuddyWater using localized ClickFix variants against Armenian organizations — no specific network IOCs for these nation-state operations were available in the sources reviewed, so none are asserted below.

Because ClickFix relies entirely on tricking a human into self-executing a command — not on any software vulnerability — there is no vendor patch; defense depends on user-awareness training, blocking known landing-page infrastructure, and behavioral/registry-based detection (RunMRU and TypedPaths registry-key monitoring, PowerShell Script Block Logging, and process-lineage rules for browser/explorer.exe spawning conhost.exe or scripting interpreters).

MITRE ATT&CK techniques used in TL-2026-1130

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1127 Trusted Developer Utilities Proxy Execution; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1087 Account Discovery

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

stealth

T1218 System Binary Proxy Execution

Impact

T1486 Data Encrypted for Impact

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities

Affected products and versions in ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

  • Microsoft — Windows (Run dialog / PowerShell / cmd.exe execution surface)
    Vulnerable versions: All supported Windows versions - technique abuses built-in OS functionality
    Fixed in: N/A - social-engineering technique, not a software vulnerability
  • Apple — macOS (Terminal / sudo prompt execution surface)
    Vulnerable versions: All supported macOS versions - technique abuses built-in OS functionality
    Fixed in: N/A - social-engineering technique, not a software vulnerability
  • WordPress — WordPress CMS sites with outdated/vulnerable plugins or themes (KongTuke injection vector)
    Vulnerable versions: Sites running outdated or misconfigured plugins/themes
    Fixed in: Depends on the specific compromised plugin/theme; keep all extensions patched and remove unused plugins

Remediation for ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

Patches

  • N/A — ClickFix is a social-engineering / user-execution technique, not a software vulnerability; no vendor security patch applies to the technique itself
  • Apply available security patches to any outdated WordPress plugins/themes identified during compromise-assessment of externally-facing WordPress sites, to remove the KongTuke JavaScript-injection vector

Immediate actions

  • Block/sinkhole confirmed ClickFix infrastructure at DNS, web proxy, and firewall: dntds.shop, 89.190.158.132, foodgefy.com, 162.33.178.171, nitzschi.com, windlrr.com
  • Alert on writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU containing base64, checkmark-emoji, escape characters, or LOLBin filenames
  • Deploy web/email filtering rules for fake reCAPTCHA / Cloudflare Turnstile / 'verify you are human' / browser-update lure pages
  • Hunt for explorer.exe or browser processes spawning conhost.exe with --headless, powershell.exe, mshta.exe, rundll32.exe, msbuild.exe, or regasm.exe as a child process

Workarounds

  • Restrict or monitor Win+R Run-dialog usage via GPO/AppLocker/WDAC in high-risk user populations
  • Use DNS filtering / secure web gateway categories to block newly-registered and known ClickFix TDS/redirector domains
  • Where feasible, disable or alert on clipboard-to-Run-dialog and clipboard-to-Terminal execution pathways via endpoint policy

Longer-term hardening

  • Enable PowerShell Script Block Logging and Constrained Language Mode enterprise-wide; ship logs to SIEM for T1059.001 detections
  • Roll out organization-wide user-awareness training specifically covering ClickFix/fake-CAPTCHA copy-paste lures, including FileFix and TerminalFix variants
  • Deploy EDR behavioral rules mapped to MITRE T1204.004 (Malicious Copy and Paste) rather than relying solely on static IOC blocklists, given rapid infrastructure rotation
  • Audit and patch WordPress plugins/themes on public-facing sites to close the injection vector abused by the KongTuke TDS cluster

Weaknesses (CWE) in ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

CWE-451

Timeline of ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

  • ClickFix ('paste-and-run' / fake-CAPTCHA clipboard-hijacking) technique first documented in the wild as a novel user-execution initial-access vector.
  • MITRE formally adds sub-technique T1204.004 'User Execution: Malicious Copy and Paste' to Enterprise ATT&CK in recognition of ClickFix's prevalence.
  • Microsoft Security Blog publishes 'Think before you ClickFix,' a detailed technical breakdown of the attack chain, LOLBins abused, and detection guidance.
  • Huntress reports a 631% increase in ClickFix-related incidents across the measurement window of August 2024 to August 2025.
  • Trend Micro publishes MDR-driven analysis of the KongTuke cluster abusing 300+ compromised WordPress sites and 40+ TDS domains to funnel victims into ClickFix pages delivering modeloRAT and ransomware-affiliate payloads (Rhysida, Interlock, 8Base, Akira, AlphV/BlackCat).
  • Malwarebytes reports 700+ education and technology-sector websites hijacked in a large-scale ClickFix malware campaign.
  • ANY.RUN publishes 'ClickFix: Technique Overview,' documenting dntds.shop and destination IP 89.190.158.132 as observed ClickFix sandbox infrastructure and cataloguing the malware families delivered via the technique.
  • Microsoft Security Blog documents a ClickFix campaign using fake macOS utility lures to deliver infostealers (Atomic macOS Stealer / AMOS) via TerminalFix/DownloadFix variants.
  • TL-2026-1130 RESEARCH phase independently re-verifies the source SOC-triage article's cited example IOCs and confirms dntds.shop / 89.190.158.132 as genuine active ClickFix infrastructure via ANY.RUN, ThreatFox, Gridinsoft, and urlscan.io, reclassifying this record from a non-threat skip into a sourced technique-intelligence briefing.

Sources cited for ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

Threats related to ClickFix / KongTuke Clipboard-Hijacking Social-Engineering

Detection coverage for TL-2026-1130

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1130 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1130

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats