ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)

Key facts for ClickFix fake CAPTCHA lure

Detection coverage for ClickFix fake CAPTCHA lure

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5135 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Paste-and-Run Shell Spawned from Explorer (Run Dialog / Netlas VBS-MSI Chain)

Detects cmd, PowerShell, mshta or script-host processes launched by explorer.exe (the Win+R Run dialog or Win+X Terminal paste step of a ClickFix fake CAPTCHA) whose command line carries download-and-execute tokens. Covers the generic paste patterns (Invoke-Expression, DownloadString, FromBase64String, curl) and the Netlas-documented chain that uses WinHttp.WinHttpRequest to fetch ny.vbs and OIVPGEXM.msi from 198.13.158.127:5506. Because the victim launches the shell manually, file-download and macro controls never fire, so the process lineage is the reliable signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1059.005, T1027, T1140
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security_4688
• Severity: high
• Confidence: high

Splunk SPL

```Detect ClickFix paste-and-run: shell spawned by explorer.exe carrying download-execute tokens (TL-2026-5135, T1204.004)```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*explorer.exe" (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*mshta.exe" OR Image="*wscript.exe" OR Image="*cscript.exe") (CommandLine="*WinHttp.WinHttpRequest*" OR CommandLine="*ServerXMLHTTP*" OR CommandLine="*ny.vbs*" OR CommandLine="*OIVPGEXM*" OR CommandLine="*198.13.158.127*" OR (CommandLine="*http*" AND (CommandLine="*Invoke-Expression*" OR CommandLine="*iex *" OR CommandLine="*DownloadString*" OR CommandLine="*irm *" OR CommandLine="*FromBase64String*" OR CommandLine="* -enc*" OR CommandLine="*mshta*" OR CommandLine="*curl *")))
| eval clickfix_stage=case(like(CommandLine,"%ny.vbs%") OR like(CommandLine,"%198.13.158.127%") OR like(CommandLine,"%OIVPGEXM%"),"netlas_vbs_msi_chain", like(CommandLine,"%FromBase64String%") OR like(CommandLine,"% -enc%"),"encoded_paste", true(),"download_execute_paste")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as shells values(CommandLine) as command_lines by host User ParentImage clickfix_stage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// ClickFix paste-and-run: shell spawned by explorer.exe with download-execute tokens
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("WinHttp.WinHttpRequest", "ServerXMLHTTP", "ny.vbs", "OIVPGEXM", "198.13.158.127")
    or (ProcessCommandLine has "http" and ProcessCommandLine has_any ("Invoke-Expression", "iex ", "DownloadString", "irm ", "FromBase64String", "-enc", "mshta", "curl "))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: ClickFix Paste-and-Run Shell Spawned from Explorer with Download-Execute Tokens
id: 9d3b7e52-41c8-4f6a-b0e3-5a1c8d2f7e94
status: experimental
description: Detects cmd, PowerShell, mshta or script hosts launched by explorer.exe (Win+R or Terminal paste) whose command line carries ClickFix download-and-execute tokens, including the Netlas-documented WinHttpRequest ny.vbs chain from 198.13.158.127.
references:
  - https://netlas.io/blog/fake_prompts/
  - https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/
  - https://proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.t1059.005
  - attack.defense-evasion
  - attack.t1027
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_ioc:
    CommandLine|contains:
      - 'WinHttp.WinHttpRequest'
      - 'ServerXMLHTTP'
      - 'ny.vbs'
      - 'OIVPGEXM'
      - '198.13.158.127'
  selection_http:
    CommandLine|contains: 'http'
  selection_exec:
    CommandLine|contains:
      - 'Invoke-Expression'
      - 'iex '
      - 'DownloadString'
      - 'irm '
      - 'FromBase64String'
      - ' -enc'
      - 'mshta'
      - 'curl '
  condition: selection_parent and selection_image and (selection_ioc or (selection_http and selection_exec))
falsepositives:
  - Administrators or help-desk staff who start PowerShell or cmd from the Run dialog to fetch internal scripts
  - Software installers launched from Explorer that call curl or PowerShell with an HTTP URL
level: high

Known false positives:

• Administrators or help-desk staff who start PowerShell or cmd from the Run dialog to fetch internal scripts
• Software installers launched from Explorer that call curl or PowerShell with an HTTP URL

Tuning notes: Allowlist known internal script hosting URLs and approved admin accounts. If volume is high, drop the generic http-plus-exec branch and keep only the IOC tokens, or require the browser to have been the foreground process in the preceding 60 seconds. Ensure Sysmon EventCode 1 (or Windows 4688 with command-line auditing) is collected from all endpoints.

• 🔒 ClickFix Pasted Download-Execute Command Recorded in Run Dialog History (RunMRU) · unlock with TL Creds
• 🔒 macOS AMOS ClickFix Chain - Hidden [indicator], com.finder[indicator] LaunchDaemon and Fake Password Prompt · unlock with TL Creds
• 🔒 NetSupport RAT client32.exe from User-Writable Path or Known Hash with C2 Beaconing · unlock with TL Creds
• 🔒 ClickFix Stage-1 VBScript Downloader (WinHttpRequest / [indicator]) · unlock with TL Creds
• 🔒 ClickFix DLL Side-Loading (jp2launcher.exe msvcp140.dll, [indicator] [indicator], Known Malicious Hashes) · unlock with TL Creds
• 🔒 ClickFix Payload Domains - Fake DocuSign/Okta Lures, Latrodectus, Lumma and DarkGate C2 · unlock with TL Creds
• 🔒 Silent MSI Install and Injection Chain (HijackLoader/DeerStealer, [indicator], SigmaServ/XPFix) · unlock with TL Creds
• 🔒 ClickFix Infrastructure Contact (Netlas Chain, DeerStealer C2 and Community-Observed Siblings) · unlock with TL Creds

Indicators of compromise for ClickFix fake CAPTCHA lure

As of 2026-11-03, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5135.

Sample indicators (3 of 28)

• IP address: 198.13.158[.]127
• Domain: docusign[.]sa[.]com
• File hash: 02a9692c6ae6cb862657390e9d1adc6ea21ba810e73831ef3dc973b40f8d8966

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

How ClickFix fake CAPTCHA lure works

ClickFix (also seen as FakeCaptcha / fake-prompt attacks) turns the victim into the execution mechanism. Victims reach a fake verification page through phishing email, malvertising, SEO poisoning, compromised websites (e.g. ClearFake injections) or, more recently, sponsored search results that point to publicly shared ChatGPT/Grok conversations. The page imitates a CAPTCHA, Cloudflare check, browser error or document error. JavaScript silently writes a command to the clipboard and the page instructs the user to press Win+R (or Win+X then open Terminal, or open macOS Terminal), paste, and press Enter. Because the user launches PowerShell/cmd/Terminal manually, the activity bypasses controls that rely on file-download or macro execution and can look like legitimate administrative behaviour.

Netlas documents one payload chain: the pasted command is a cmd /c one-liner that uses WinHttp.WinHttpRequest.5.1 to fetch and execute http://198.13.158.127:5506/ny.vbs, which in turn downloads an MSI (OIVPGEXM.msi, SHA-256 02a9692c6ae6cb862657390e9d1adc6ea21ba810e73831ef3dc973b40f8d8966) via MSXML2.ServerXMLHTTP.6.0 and installs it silently with msiexec /i ... /quiet /qn. The MSI drops Sw_C64.exe and a legitimate-library-abusing CCleanerReactivator.dll (exported function ?RunProgram@AutoReactivatorSDK@@YA_NPEB_WH@Z) used as an execution gadget. Post-installation behaviour includes process injection into SigmaServ.exe and XPFix.exe and WebSocket-based C2; the chain is associated by Netlas with HijackLoader and DeerStealer, with DeerStealer traffic observed to 104.21.92.181:80 (a Cloudflare-fronted address) and a landing page at 174.142.195.203. Netlas fingerprints the fake pages by the title 'Checking if you are human', body markers such as k4zrz92z, a check-mark glyph and 'Ctrl', the checkboxWindow JavaScript identifier, favicon reuse and certificate patterns, and reports ~1,672 active matching domains.

Other vendors document further chains. Unit 42 reports a May 2025 NetSupport RAT campaign (fake DocuSign/Okta pages, possibly over ClearFake infrastructure; PowerShell downloads a ZIP, jp2launcher.exe side-loads a malicious msvcp140.dll which retrieves client32.exe), a March-April 2025 Latrodectus campaign (ClearFake redirect, curl.exe + JavaScript downloader, MSI, side-loaded libcef.dll) and a Lumma Stealer campaign (mshta, typosquatted IP-logger domain, AutoIt loader). Proofpoint first observed the technique used by TA571 on 1 March 2024 and by the ClearFake cluster in early April 2024, delivering DarkGate, Matanbuchus, NetSupport RAT, Lumma, Amadey, XMRig, Vidar and JaskaGO. In December 2025 Huntress/Kaspersky/BleepingComputer reported Google ads leading macOS users to shared ChatGPT/Grok conversations that instructed them to paste a Terminal command installing the AMOS infostealer (hidden .helper file, com.finder.helper LaunchDaemon persistence, fake password prompt).

Prevalence: ESET reported that ClickFix/HTML FakeCaptcha detections grew 517% between H2 2024 and H1 2025 and accounted for nearly 8% of blocked attacks; Netlas also cites Microsoft's 2025 Digital Defense Report figure of 47% of recorded intrusions (as relayed by Netlas, not independently verified here). Netlas lists actors reported to use the technique: ClearFake, TA571, Callisto, Sednit, Lazarus Group, Kimsuky, DeceptiveDevelopment (WeaselStore, GitHub supply-chain lures), MuddyWater and APT36 (Linux targeting). Attribution of any single campaign in this record is not asserted; the technique is shared across criminal and state-aligned operators. Note: WeaselStore and DeerStealer/HijackLoader specifics rest on the Netlas article alone; BeaconBeagle was unreachable (HTTP 502) during research so no C2 correlation was recorded.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.007 System Binary Proxy Execution: Msiexec

Collection

T1056.002 Input Capture: GUI Input Capture

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools

Discovery

T1082 System Information Discovery

Persistence

T1543.004 Create or Modify System Process: Launch Daemon

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Initial Access

T1566 Phishing

stealth

T1574.001 DLL

Remediation for ClickFix fake CAPTCHA lure

Immediate actions

• Block 198.13.158.127, 174.142.195.203 and the listed domains at DNS/proxy/firewall and hunt for historical connections
• Search endpoints for msiexec /i ... /quiet /qn launched from wscript/cscript/cmd, and for Sw_C64.exe / CCleanerReactivator.dll
• Review HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU for pasted download/execute commands
• Isolate affected hosts and reset credentials, session tokens and crypto-wallet secrets exposed to stealers

Workarounds

• Restrict or disable the Windows Run dialog (Win+R) for users who do not need it via Group Policy
• Alert on powershell.exe, cmd.exe and wscript.exe launched from explorer.exe shortly after browser activity

Longer-term hardening

• Enable PowerShell script block logging and transcription
• Deploy EDR/UEBA analytics correlating browser activity, clipboard use and shell process creation
• DNS filtering for newly registered and lookalike domains; browser isolation and CSP enforcement
• Remove local admin rights and restrict mshta.exe and PowerShell from user-writable paths
• User awareness training covering paste-and-run lures, including AI-assistant and search-ad delivery on macOS

Affected and fixed versions

• Microsoft — Windows (Run dialog, PowerShell, Terminal)
  Vulnerable versions: All versions - user-execution technique, no software flaw
• Apple — macOS (Terminal)
  Vulnerable versions: All versions - user-execution technique, no software flaw
• Linux — Linux desktop shells
  Vulnerable versions: Targeted per Netlas (APT36); no software flaw

Timeline of ClickFix fake CAPTCHA lure

• 2024-03-01 Proofpoint observes TA571 using the paste-a-PowerShell-command technique in a campaign of over 100,000 messages.
• 2024-04-01 ClearFake cluster adopts the clipboard/PowerShell social-engineering technique (early April 2024 per Proofpoint).
• 2024-04-15 Proofpoint identifies a separate 'ClickFix' activity cluster in mid-April 2024, later replaced by ClearFake content.
• 2025-03-01 Unit 42 observes a March-April 2025 campaign delivering Latrodectus via ClickFix after ClearFake redirection.
• 2025-04-01 Unit 42 notes an April 2025 surge in ClickFix-delivered Lumma Stealer (mshta and AutoIt loader chain).
• 2025-05-01 Unit 42 documents a prolific May 2025 NetSupport RAT campaign using fake DocuSign/Okta verification pages across healthcare, legal, telecom, retail and mining.
• 2025-12-09 Kaspersky first spots Google ads leading macOS users to shared ChatGPT/Grok conversations that deliver AMOS via pasted Terminal commands.
• 2025-12-10 Huntress publishes detailed analysis of the AMOS campaign; BleepingComputer reports it.
• 2026-01-30 Netlas publishes 'Inside ClickFix', documenting the VBScript/MSI chain, ~1,672 active fake-prompt domains and actor attributions.

Sources cited for ClickFix fake CAPTCHA lure

• Unit 42: Preventing the ClickFix Attack Vector Unit 42 · Research
• Proofpoint: Clipboard Compromise - PowerShell Self-Pwn Proofpoint · Research
• ESET Threat Report H1 2025 ESET WeLiveSecurity · Research
• Microsoft Security Blog: ClickFix guidance Microsoft · Vendor report
• Inside ClickFix: How Fake Prompts Took Over the Web (Netlas) netlas.io · Blog · 2026-01-30
• Kaspersky: ClickFix technique - what it is and why it is dangerous Kaspersky · Blog
• BleepingComputer: Google ads for shared ChatGPT, Grok guides push macOS infostealer BleepingComputer · News · 2025-12-10
• Infosecurity Magazine: ClickFix Attacks Surge 517% in 2025 infosecurity-magazine.com · News

More in malware

• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
• SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft
• Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity