This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to steal browser credentials, cryptocurrency-wallet data, and Telegram sessions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A free image editor says, ‘Verify you are human.’ Sounds normal? Then it tells you to copy a command into PowerShell. That’s ClickFix: the ‘CAPTCHA’ gets you to run the malware yourself. In one case, that command launched CastleLoader, then NetSupport RAT and a .NET stealer targeting browser passwords, wallet data, and Telegram sessions. Remember: a real CAPTCHA doesn’t need PowerShell. If one asks, don’t run it, report the page to security.
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
A Rust-based remote access trojan (CikaBika Bot) was delivered using a document-themed lure that included a malicious Windows shortcut (LNK) and a PDF containing an embedded payload. Once installed, it used Discord as its command-and-control channel to run commands, collect information, and steal…
Barracuda reports attackers are abusing fake CAPTCHA pages as a “trust step” to push victims into credential theft, malware downloads, and enabling malicious browser notifications. In some “ClickFix” variants, the CAPTCHA flow tricks users into pasting and running a command on their own Windows…
A weekly threat roundup includes multiple real-world social engineering campaigns, including a phishing operation that abuses legitimate Power BI domains to look trustworthy and trick users into downloading a remote-access tool installer. It also describes a WhatsApp-delivered lure that tricks…
