Researchers observed real-world infections where compromised WordPress sites showed a fake “Cloudflare Turnstile” verification and instructed visitors to press Win+R and run a PowerShell command. The attacker’s page guides victims step-by-step (and reports progress back to the operator) to execute malware without a traditional email attachment.
Researchers observed real-world infections tied to a framework called Exvicy that relies on compromised WordPress sites rather than email attachments. The framework injects obfuscated JavaScript into these sites, which loads a fake Cloudflare Turnstile check, the kind of human verification checkbox many users see routinely online. Instead of simply confirming the visitor is human, the page instructs victims to press Win+R, paste a command already copied to their clipboard, and press Enter, running a PowerShell command. Instructions were observed in 13 languages, suggesting the operation targets a broad, international set of victims.
The attack works because it borrows the visual language of a familiar, trusted process, a Cloudflare-style verification checkbox that most people have clicked without thinking. By moving the actual malicious action to a system-level dialog (Win+R) rather than a browser download or email attachment, the attackers sidestep controls that are tuned to catch malicious attachments or links. The page also reports each step back to the operator, including when the victim clicks the fake checkbox, and polls for several minutes to confirm the command ran, indicating an active, monitored infection flow rather than a passive drive-by page.
Telemetry showed hosts communicating with Exvicy command-and-control infrastructure across multiple environments, and researchers identified roughly 80 hosts serving the framework's admin panel, indicating this is an active, ongoing operation rather than an isolated incident.
Organizations should train staff to never run commands on a website, including Win+R and PowerShell, just to complete a "verification." Employees should be told explicitly that a legitimate check will never ask them to open the Run dialog or execute a clipboard-copied command. Because this technique relies on compromised legitimate sites rather than phishing emails, awareness training should emphasize that everyday web browsing can be an infection path, not just inbox activity. Web and marketing teams that manage WordPress sites should also be included in awareness efforts, since site compromise is the entry point that makes this entire chain possible. Encouraging employees to close suspicious pages and report them to security, rather than proceeding, is the most direct way to break this attack chain before code executes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Exvicy is a malware delivery framework that injects obfuscated JavaScript into compromised WordPress sites, showing a fake Cloudflare Turnstile check that instructs visitors to run a PowerShell command via Win+R.
The page presents a checkbox that looks like a normal human verification step, then guides victims to paste and run a clipboard-copied PowerShell command, reporting each step back to the operator and polling for confirmation that the command ran.
Because the malware delivery happens through a legitimate but compromised website that employees may visit during normal browsing, meaning it can bypass email-focused security controls entirely.
They should close the page immediately and report it to security, since no legitimate website verification step requires running a PowerShell command from the Run dialog.
You land on a normal WordPress site, and a big Cloudflare Turnstile box pops up: “Please verify you are human.” But this one is fake. It tells you, in multiple languages, to press Win plus R and run a PowerShell command it already copied to your clipboard, so Exvicy malware can phone home to its C2 servers. Real Cloudflare checks never ask you to open the Run dialog or PowerShell. A website that walks you step-by-step through Win plus R, paste, Enter, and even “monitors” your progress, isn’t verification, it’s malware delivery. If any site tells you to press Win plus R or run a copied command to “prove you’re human,” close the tab and report it to security immediately.
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Researchers report a real, active malware operation where compromised websites use “ClickFix” style prompts to trick people into manually pasting and running malicious commands. The result is a multi-stage infection that downloads additional payloads and ultimately runs TELEPUZ, which can steal…
