ClickFix-Themed Phishing Kits Exploiting Fake CAPTCHA Social Engineering
Security researchers have identified a surge in phishing campaigns leveraging the ClickFix social engineering technique, which exploits fake CAPTCHA challenges to compromise users. Palo Alto Networks discovered the 'IUAM ClickFix Generator,' a web-based phishing kit that enables attackers with minimal technical skills to craft convincing phishing pages. These pages mimic legitimate browser verification prompts, such as those used by content delivery networks and cloud security providers, to deceive users into believing they are interacting with authentic security checks. The phishing kit allows customization of the page's title, domain, content, and prompts, making each attack highly tailored and more likely to succeed. A key feature of the kit is its ability to detect the victim's operating system—Windows or macOS—and adjust the malicious payload accordingly, increasing the likelihood of successful exploitation. The phishing pages generated by this tool often instruct users to perform actions such as pressing Windows + R, pasting clipboard contents, and executing commands, which can result in the installation of infostealers or remote access trojans. The attack relies on clipboard manipulation, where the phishing page silently injects a malicious command into the user's clipboard, masked by a harmless-looking string to evade suspicion. Researchers have linked some of these campaigns to the Odyssey malware-as-a-service operation, suggesting a broader criminal ecosystem utilizing the ClickFix technique. The IUAM ClickFix Generator also incorporates obfuscation and automatic clipboard-copy JavaScript injection to further evade detection. Eye Security and other cybersecurity experts have observed that these attacks are distributed through various channels, including SEO poisoning, malvertising, and spearphishing. In response, Eye Security developed 'ClickFix Block,' a browser extension designed to detect and block fake CAPTCHA attacks before they can manipulate the clipboard. The extension is available for Chrome and Edge browsers and aims to provide early protection against this emerging threat. The rise of ClickFix attacks highlights the evolving sophistication of social engineering tactics, as attackers increasingly exploit familiar web security mechanisms to gain user trust. The campaigns target both Windows and macOS users, demonstrating cross-platform adaptability. Security researchers emphasize the importance of user awareness and technical defenses, such as browser extensions, to mitigate the risk posed by these phishing kits. The ongoing analysis of ClickFix-themed attacks underscores the need for organizations to update their security training and technical controls to address this novel threat vector. The discovery of customizable phishing kits like IUAM ClickFix Generator signals a democratization of advanced phishing techniques, making them accessible to a wider range of cybercriminals. As these attacks continue to evolve, collaboration between security vendors and researchers remains critical to developing effective countermeasures. Organizations are advised to monitor for signs of clipboard manipulation and educate users about the dangers of executing commands copied from untrusted web pages. The ClickFix phenomenon represents a significant shift in phishing tactics, leveraging both technical and psychological manipulation to achieve compromise.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Expel documents cache-smuggling ClickFix/FileFix variant
Expel described a newer ClickFix variant using cache smuggling, in which a disguised payload is stored in the browser cache so a pasted command can execute it without an explicit download at run time. Reporting said victims could be tricked into pasting a malicious command into Windows File Explorer or PowerShell, helping the attack evade controls that inspect downloads and network activity.
Unit 42 uncovers IUAM ClickFix Generator phishing kit
Palo Alto Networks Unit 42 analyzed a web-based phishing kit called IUAM ClickFix Generator that lets low-skill attackers create customizable browser-verification phishing pages and automate clipboard-based ClickFix execution flows. Researchers observed pages generated by the kit targeting Windows and macOS users to deliver malware including DeerStealer and Odyssey Stealer, with at least one campaign linked to the Odyssey MaaS ecosystem.
WordPress sites compromised to serve ClickFix-style fake verification pages
Researchers reported an ongoing campaign in which attackers modified WordPress theme files such as functions.php to load remote JavaScript and hidden iframes from infrastructure including porsasystem[.]com and brazilc[.]com. The infection chain redirected visitors to fake Cloudflare-style verification pages used for scams or malware delivery.
Eye Security releases ClickFix Block protection for fake CAPTCHA attacks
Eye Security published research and a defensive measure called ClickFix Block aimed at protecting users against fake CAPTCHA and browser-verification social-engineering attacks. The release reflects a defensive response to the growing use of ClickFix-style lures in malware campaigns.
Commercial ClickFix builders begin proliferating on underground forums
Microsoft previously warned that commercial ClickFix builder kits had been spreading on underground forums since late 2024. The kits advertised fake verification lures, including Cloudflare-themed pages, and command-generation features designed to help attackers bypass defenses.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
New ClickFix attacks uncovered
scworld.com
Open sourceNew FileFix attack uses cache smuggling to evade security software
bleepingcomputer.com
Open sourceResearchers uncover ClickFix-themed phishing kit
helpnetsecurity.com
Open sourceHackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks
thehackernews.com
Open sourceClickFix Block: protect against fake CAPTCHA attacks | Eye Security
research.eye.security
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ClickFix Social Engineering Attacks Spread Infostealers via TikTok and Other Channels
Cybercriminals are increasingly leveraging ClickFix-style social engineering attacks to distribute information-stealing malware, with a notable surge in campaigns utilizing popular platforms such as TikTok. In these attacks, threat actors create videos or web pages that purport to offer legitimate activation guides or fixes for widely used software, including Windows, Microsoft 365, Adobe Premiere, Photoshop, CapCut Pro, and Discord Nitro. The core technique involves tricking users into copying and pasting malicious PowerShell commands or scripts into their systems, often under the guise of resolving software issues or unlocking premium features. Once executed, these commands connect to attacker-controlled infrastructure to download and run additional payloads, such as the Aura Stealer malware, which is designed to harvest browser credentials, authentication cookies, cryptocurrency wallet information, and other sensitive data. The attacks are highly effective due to their use of legitimate-looking lures, such as fake CAPTCHAs, embedded instructional videos, and professional web design, which lower user suspicion and bypass traditional security awareness training that focuses on phishing links and suspicious downloads. Security researchers have linked these tactics to both financially motivated cybercriminal groups, such as Interlock ransomware, and state-sponsored advanced persistent threats (APTs). Recent public breaches at organizations like Kettering Health, DaVita, City of St. Paul, and Texas Tech University Health Sciences Centers have been attributed to ClickFix-style techniques, though the full extent of their impact is likely underreported. The attacks are further amplified by the viral nature of social media platforms, where malicious videos can quickly reach large audiences. Technical analysis reveals that the malicious scripts often use JavaScript to automate clipboard actions, making the attack seamless for the victim. Once the initial payload is executed, additional malware may be downloaded to establish persistence or exfiltrate data. Security experts warn that user education must evolve to address these new attack vectors, emphasizing the dangers of running copied commands and the importance of verifying the source of any technical instructions. Organizations are advised to implement technical controls to block suspicious script execution and to monitor for signs of credential theft and unauthorized access. The growing prevalence of ClickFix attacks highlights the need for a multi-layered defense strategy that combines user awareness, endpoint protection, and proactive threat intelligence.
Mar 21, 2026
ClickFix Malware Attacks Employ Advanced Social Engineering and Multi-OS Support
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Mar 21, 2026
ClickFix and FileFix Social Engineering Techniques for Malware Delivery
Cybercriminals are leveraging social engineering techniques known as ClickFix and its new variant, FileFix, to trick users into executing malicious commands on their Windows systems. The ClickFix method involves compromised websites displaying fake CAPTCHA-style pages that prompt users to "verify you are human." When users interact with these pages, malicious content is injected into their clipboard, and they are instructed to paste and run this content via the Windows Run dialog, leading to the installation of remote access tools such as NetSupport RAT. The SmartApeSG campaign is one example actively using this approach, with infection chains triggered under specific conditions on compromised sites. The FileFix variation, recently observed in the wild, shifts the attack vector by instructing users to paste malicious commands into the Windows File Explorer address bar instead of the Run dialog. This subtle change exploits user familiarity with File Explorer, making the attack less suspicious and increasing the likelihood of success. Both techniques rely on phishing emails or fake service pages to lure victims, and the end goal is typically the deployment of remote access malware. Security teams should be aware of these evolving tactics and educate users about the risks of following unsolicited instructions involving system dialogs or file paths.
Apr 6, 2026