Cisco Talos described real ClickFix campaigns where attackers trick people into pasting code either into the Chrome address bar (or a browser extension) or into the Windows Run dialog. The first campaign targeted crypto swap sites and used a fake “leaked vulnerability report” to get victims to run browser-based JavaScript that silently swaps cryptocurrency deposit addresses. A second campaign used a fake Google CAPTCHA to push a WebDAV-based malware loader that ultimately delivered infostealers and remote-access tooling.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If a website or “leaked report” tells you to paste code into Chrome or Windows Run, stop. That’s the ClickFix trick. One ClickFix campaign used a fake leaked vulnerability report on Telegram and forums, promising 38% higher crypto swap payouts if you paste JavaScript into Chrome or install it in Tampermonkey. Another shows a fake Google CAPTCHA over a website, telling Windows users: open Run, paste this command, press Enter. Behind the scenes it opens a WebDAV path and runs malware via rundll32. Aha moment: real sites and CAPTCHAs never need you to paste code into Chrome, Run, or a terminal. If any page asks you to, close it and report it to security immediately.
Threat actors are using fake CAPTCHA pages on compromised or lookalike websites to trick people into copying and pasting malicious commands (“paste and run”). The article describes real campaigns tied to CastleLoader and similar activity, including fake background-removal sites and job-site…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
