# ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)

> ClickFix is a social-engineering technique in which fake CAPTCHA/verification pages silently copy a malicious command to the clipboard and instruct victims to paste and run it via the Windows Run dialog, PowerShell/Terminal or macOS Terminal. Documented chains deliver DeerStealer, HijackLoader, AMOS, NetSupport RAT, Latrodectus, Lumma Stealer and others, and the technique is used by both cybercriminal and state-aligned actors.

- **Published:** 2026-11-03T08:45:36Z
- **Last reviewed:** 2026-11-03T08:45:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5135
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5135.png
- **ID:** TL-2026-5135
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA571
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

ClickFix (also seen as FakeCaptcha / fake-prompt attacks) turns the victim into the execution mechanism. Victims reach a fake verification page through phishing email, malvertising, SEO poisoning, compromised websites (e.g. ClearFake injections) or, more recently, sponsored search results that point to publicly shared ChatGPT/Grok conversations. The page imitates a CAPTCHA, Cloudflare check, browser error or document error. JavaScript silently writes a command to the clipboard and the page instructs the user to press Win+R (or Win+X then open Terminal, or open macOS Terminal), paste, and press Enter. Because the user launches PowerShell/cmd/Terminal manually, the activity bypasses controls that rely on file-download or macro execution and can look like legitimate administrative behaviour.

Netlas documents one payload chain: the pasted command is a cmd /c one-liner that uses WinHttp.WinHttpRequest.5.1 to fetch and execute http://198.13.158.127:5506/ny.vbs, which in turn downloads an MSI (OIVPGEXM.msi, SHA-256 02a9692c6ae6cb862657390e9d1adc6ea21ba810e73831ef3dc973b40f8d8966) via MSXML2.ServerXMLHTTP.6.0 and installs it silently with msiexec /i ... /quiet /qn. The MSI drops Sw_C64.exe and a legitimate-library-abusing CCleanerReactivator.dll (exported function ?RunProgram@AutoReactivatorSDK@@YA_NPEB_WH@Z) used as an execution gadget. Post-installation behaviour includes process injection into SigmaServ.exe and XPFix.exe and WebSocket-based C2; the chain is associated by Netlas with HijackLoader and DeerStealer, with DeerStealer traffic observed to 104.21.92.181:80 (a Cloudflare-fronted address) and a landing page at 174.142.195.203. Netlas fingerprints the fake pages by the title 'Checking if you are human', body markers such as k4zrz92z, a check-mark glyph and 'Ctrl', the checkboxWindow JavaScript identifier, favicon reuse and certificate patterns, and reports ~1,672 active matching domains.

Other vendors document further chains. Unit 42 reports a May 2025 NetSupport RAT campaign (fake DocuSign/Okta pages, possibly over ClearFake infrastructure; PowerShell downloads a ZIP, jp2launcher.exe side-loads a malicious msvcp140.dll which retrieves client32.exe), a March-April 2025 Latrodectus campaign (ClearFake redirect, curl.exe + JavaScript downloader, MSI, side-loaded libcef.dll) and a Lumma Stealer campaign (mshta, typosquatted IP-logger domain, AutoIt loader). Proofpoint first observed the technique used by TA571 on 1 March 2024 and by the ClearFake cluster in early April 2024, delivering DarkGate, Matanbuchus, NetSupport RAT, Lumma, Amadey, XMRig, Vidar and JaskaGO. In December 2025 Huntress/Kaspersky/BleepingComputer reported Google ads leading macOS users to shared ChatGPT/Grok conversations that instructed them to paste a Terminal command installing the AMOS infostealer (hidden .helper file, com.finder.helper LaunchDaemon persistence, fake password prompt).

Prevalence: ESET reported that ClickFix/HTML FakeCaptcha detections grew 517% between H2 2024 and H1 2025 and accounted for nearly 8% of blocked attacks; Netlas also cites Microsoft's 2025 Digital Defense Report figure of 47% of recorded intrusions (as relayed by Netlas, not independently verified here). Netlas lists actors reported to use the technique: ClearFake, TA571, Callisto, Sednit, Lazarus Group, Kimsuky, DeceptiveDevelopment (WeaselStore, GitHub supply-chain lures), MuddyWater and APT36 (Linux targeting). Attribution of any single campaign in this record is not asserted; the technique is shared across criminal and state-aligned operators. Note: WeaselStore and DeerStealer/HijackLoader specifics rest on the Netlas article alone; BeaconBeagle was unreachable (HTTP 502) during research so no C2 correlation was recorded.

## MITRE ATT&CK

- T1566 Phishing
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1218.007 System Binary Proxy Execution: Msiexec
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1574.001 DLL
- T1543.004 Create or Modify System Process: Launch Daemon
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.002 Input Capture: GUI Input Capture
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Paste-and-Run Shell Spawned from Explorer (Run Dialog / Netlas VBS-MSI Chain)** (`TL-2026-5135-SPL-001`)

Detects cmd, PowerShell, mshta or script-host processes launched by explorer.exe (the Win+R Run dialog or Win+X Terminal paste step of a ClickFix fake CAPTCHA) whose command line carries download-and-execute tokens. Covers the generic paste patterns (Invoke-Expression, DownloadString, FromBase64String, curl) and the Netlas-documented chain that uses WinHttp.WinHttpRequest to fetch ny.vbs and OIVPGEXM.msi from 198.13.158.127:5506. Because the victim launches the shell manually, file-download and macro controls never fire, so the process lineage is the reliable signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1059.005, T1027, T1140
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security_4688
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Detect ClickFix paste-and-run: shell spawned by explorer.exe carrying download-execute tokens (TL-2026-5135, T1204.004)```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*explorer.exe" (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*mshta.exe" OR Image="*wscript.exe" OR Image="*cscript.exe") (CommandLine="*WinHttp.WinHttpRequest*" OR CommandLine="*ServerXMLHTTP*" OR CommandLine="*ny.vbs*" OR CommandLine="*OIVPGEXM*" OR CommandLine="*198.13.158.127*" OR (CommandLine="*http*" AND (CommandLine="*Invoke-Expression*" OR CommandLine="*iex *" OR CommandLine="*DownloadString*" OR CommandLine="*irm *" OR CommandLine="*FromBase64String*" OR CommandLine="* -enc*" OR CommandLine="*mshta*" OR CommandLine="*curl *")))
| eval clickfix_stage=case(like(CommandLine,"%ny.vbs%") OR like(CommandLine,"%198.13.158.127%") OR like(CommandLine,"%OIVPGEXM%"),"netlas_vbs_msi_chain", like(CommandLine,"%FromBase64String%") OR like(CommandLine,"% -enc%"),"encoded_paste", true(),"download_execute_paste")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as shells values(CommandLine) as command_lines by host User ParentImage clickfix_stage
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// ClickFix paste-and-run: shell spawned by explorer.exe with download-execute tokens
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("WinHttp.WinHttpRequest", "ServerXMLHTTP", "ny.vbs", "OIVPGEXM", "198.13.158.127")
    or (ProcessCommandLine has "http" and ProcessCommandLine has_any ("Invoke-Expression", "iex ", "DownloadString", "irm ", "FromBase64String", "-enc", "mshta", "curl "))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Paste-and-Run Shell Spawned from Explorer with Download-Execute Tokens
id: 9d3b7e52-41c8-4f6a-b0e3-5a1c8d2f7e94
status: experimental
description: Detects cmd, PowerShell, mshta or script hosts launched by explorer.exe (Win+R or Terminal paste) whose command line carries ClickFix download-and-execute tokens, including the Netlas-documented WinHttpRequest ny.vbs chain from 198.13.158.127.
references:
  - https://netlas.io/blog/fake_prompts/
  - https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/
  - https://proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.t1059.005
  - attack.defense-evasion
  - attack.t1027
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_ioc:
    CommandLine|contains:
      - 'WinHttp.WinHttpRequest'
      - 'ServerXMLHTTP'
      - 'ny.vbs'
      - 'OIVPGEXM'
      - '198.13.158.127'
  selection_http:
    CommandLine|contains: 'http'
  selection_exec:
    CommandLine|contains:
      - 'Invoke-Expression'
      - 'iex '
      - 'DownloadString'
      - 'irm '
      - 'FromBase64String'
      - ' -enc'
      - 'mshta'
      - 'curl '
  condition: selection_parent and selection_image and (selection_ioc or (selection_http and selection_exec))
falsepositives:
  - Administrators or help-desk staff who start PowerShell or cmd from the Run dialog to fetch internal scripts
  - Software installers launched from Explorer that call curl or PowerShell with an HTTP URL
level: high
```

**Known false positives:**

- Administrators or help-desk staff who start PowerShell or cmd from the Run dialog to fetch internal scripts
- Software installers launched from Explorer that call curl or PowerShell with an HTTP URL

**Tuning notes:** Allowlist known internal script hosting URLs and approved admin accounts. If volume is high, drop the generic http-plus-exec branch and keep only the IOC tokens, or require the browser to have been the foreground process in the preceding 60 seconds. Ensure Sysmon EventCode 1 (or Windows 4688 with command-line auditing) is collected from all endpoints.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Pasted Download-Execute Command Recorded in Run Dialog History (RunMRU) (locked: unlock with TL Creds)
- macOS AMOS ClickFix Chain - Hidden [indicator], com.finder[indicator] LaunchDaemon and Fake Password Prompt (locked: unlock with TL Creds)
- NetSupport RAT client32.exe from User-Writable Path or Known Hash with C2 Beaconing (locked: unlock with TL Creds)
- ClickFix Stage-1 VBScript Downloader (WinHttpRequest / [indicator]) (locked: unlock with TL Creds)
- ClickFix DLL Side-Loading (jp2launcher.exe msvcp140.dll, [indicator] [indicator], Known Malicious Hashes) (locked: unlock with TL Creds)
- ClickFix Payload Domains - Fake DocuSign/Okta Lures, Latrodectus, Lumma and DarkGate C2 (locked: unlock with TL Creds)
- Silent MSI Install and Injection Chain (HijackLoader/DeerStealer, [indicator], SigmaServ/XPFix) (locked: unlock with TL Creds)
- ClickFix Infrastructure Contact (Netlas Chain, DeerStealer C2 and Community-Observed Siblings) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `198.13.158[.]127`
- Domain: `docusign[.]sa[.]com`
- File hash: `02a9692c6ae6cb862657390e9d1adc6ea21ba810e73831ef3dc973b40f8d8966`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Inside ClickFix: How Fake Prompts Took Over the Web (Netlas)](https://netlas.io/blog/fake_prompts/)
- [Unit 42: Preventing the ClickFix Attack Vector](https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/)
- [Proofpoint: Clipboard Compromise - PowerShell Self-Pwn](https://proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn)
- [BleepingComputer: Google ads for shared ChatGPT, Grok guides push macOS infostealer](https://www.bleepingcomputer.com/news/security/google-ads-for-shared-chatgpt-grok-guides-push-macos-infostealer-malware/)
- [ESET Threat Report H1 2025](https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2025/)
- [Infosecurity Magazine: ClickFix Attacks Surge 517% in 2025](https://www.infosecurity-magazine.com/news/clickfix-attacks-surge-2025/)
- [Microsoft Security Blog: ClickFix guidance](https://www.microsoft.com/en-us/security/blog/?p=141805)
- [Kaspersky: ClickFix technique - what it is and why it is dangerous](https://www.kaspersky.com/blog/what-is-clickfix/53348/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5135