ClickFix Campaigns Abuse Fake CAPTCHAs to Deliver Stealers and Remote Access Malware

Threat actors are compromising legitimate websites—particularly WordPress sites—and injecting fake Cloudflare, reCAPTCHA, browser-error, update, and support-verification pages that persuade visitors to paste browser-preloaded commands into Windows Run, PowerShell, or macOS Terminal. More than 250 compromised sites across at least 12 countries were identified in one automated campaign, while Australia’s ACSC warned that similar activity is targeting organizations across multiple sectors. Operators increasingly use living-off-the-land execution, including mshta, curl, cmdkey, and regsvr32, alongside in-memory payloads, DLL side-loading, scheduled tasks, registry persistence, remote SMB shares, and blockchain- or Cloudflare Pages-hosted staging to reduce disk artifacts and evade controls.

The campaigns deliver a broad and evolving payload set, including StealC, Vidar Stealer, Lumma Stealer, Venom Stealer, NetSupport RAT, Remcos, Sectop RAT, and proxy-enabled remote access tooling such as PySoxy. Stolen data includes browser credentials and cookies, cryptocurrency wallets, VPN configurations, email and gaming credentials, system profiles, and screenshots; some malware maintains access and continuously harvests newly saved credentials. Organizations should prohibit users from executing commands supplied by websites, restrict PowerShell and Windows Run where feasible, apply application control and least privilege, patch internet-facing WordPress deployments, and hunt for anomalous browser-to-clipboard activity, PowerShell or HTA execution, suspicious scheduled tasks and Run keys, remote DLL loading, and unexpected proxy processes.