A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then attempted to disable endpoint security tools like Microsoft Defender.
This campaign relied on compromised WordPress websites rather than phishing emails. An obfuscated JavaScript implant on these sites served fake verification pages designed to look like Google reCAPTCHA, Cloudflare Turnstile, or even a Windows Blue Screen of Death. Instead of a normal click to prove you're human, the page instructed visitors to copy a PowerShell command and paste it into a terminal window themselves.
That manual copy and paste step is the core of the ClickFix technique. Because the user is the one executing the command, the malicious payload can slip past defenses that are built to catch automated downloads. Once run, the command delivered the Cruciferra loader, which then injected an information stealer known as Remus onto the victim's machine.
The attack succeeded because it exploited a familiar routine. Most people are used to clicking a CAPTCHA box or waiting a moment for a security check to pass. By mimicking that experience while adding an unusual extra step, the lure normalized behavior that should raise immediate suspicion: running a command from a website. The fake Blue Screen of Death variant added urgency and confusion, both of which reduce careful thinking.
Once Cruciferra was installed, it used a signed but vulnerable driver, a technique known as bring your own vulnerable driver, along with malicious service creation to disable endpoint protection tools such as Microsoft Defender, CrowdStrike Falcon, and SentinelOne. This gave the attackers a window to operate with reduced detection risk.
Organizations should train all employees, not just technical staff, to treat any webpage request to run a script or command as a red flag. Helpdesk and IT support teams should have a clear reporting path for these incidents so users can flag suspicious pages instead of attempting to resolve them alone. Security operations teams should watch for PowerShell execution originating from browser processes, since this is a strong indicator of the ClickFix pattern. Endpoint and Windows administrators should also monitor for unexpected driver loads and new service creation events, since these are the mechanisms Cruciferra used to target installed security software.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a social engineering pattern where a fake verification page tricks a user into copying a malicious PowerShell command and manually running it, bypassing normal download defenses.
After the Cruciferra loader is installed, it uses a signed but vulnerable driver and creates a malicious service to kill security processes, including Microsoft Defender, CrowdStrike Falcon, and SentinelOne.
They appear on compromised WordPress sites that use obfuscated JavaScript to serve fake Google reCAPTCHA, Cloudflare Turnstile, or Windows Blue Screen of Death style pages.
They should treat any request to copy and run PowerShell or Terminal commands from a webpage as a likely attack and report it rather than trying to fix it themselves.
You’re browsing a normal WordPress site, and suddenly a “security check” pops up that looks like Google reCAPTCHA or Cloudflare Turnstile. But instead of “Click all the traffic lights,” it says: “Security check required: Please copy the verification command and run it in PowerShell to continue.” That’s the ClickFix trick used to drop Cruciferra malware. If you paste that command, it quietly pulls down Cruciferra, injects the Remus info-stealer, and even uses a signed-but-vulnerable driver to try to kill Microsoft Defender, CrowdStrike Falcon, and SentinelOne. Aha rule: no website should ever tell you to run PowerShell or Terminal to “verify” anything. If you see that, close the tab and report the site to Security immediately.
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Threat actors are using fake CAPTCHA pages on compromised or lookalike websites to trick people into copying and pasting malicious commands (“paste and run”). The article describes real campaigns tied to CastleLoader and similar activity, including fake background-removal sites and job-site…
Ukraine’s CERT says the Russia-linked Sandworm group is tricking targets into infecting their own PCs using compromised websites that display fake CAPTCHA checks. Victims are instructed to copy and paste a PowerShell command, which downloads malware and can lead to deeper compromise. CERT also…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
