Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill antivirus and EDR processes, increasing the chance the infection succeeds.
This campaign, tracked by eSentire, relied on compromised WordPress sites rather than phishing emails. An obfuscated ErrTraffic JavaScript injection on these sites resolved a command-and-control address before retrieving JavaScript for a fake Google reCAPTCHA, Cloudflare Turnstile, or Blue Screen of Death (BSOD) lure. The lure copied a malicious PowerShell command to the victim's clipboard and instructed them to paste and run it, a technique commonly known as ClickFix.
Once executed, the command triggered follow-on stages that used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary. The activity was associated with the Cruciferra loader, which is marketed on underground forums as capable of killing antivirus and endpoint detection and response (EDR) processes, including through a vulnerable driver.
The attack succeeded because it exploited trust in familiar web verification steps rather than a suspicious email or link. Fake reCAPTCHA and Turnstile prompts look routine to most users, so a request to "verify" by running a command can seem plausible in the moment. The use of Microsoft-signed binaries for sideloading also helped the malware blend in with legitimate system activity, reducing the chance of early detection.
This case also illustrates how attackers can combine multiple malware-as-a-service products, delivery, social engineering, and defense evasion, without needing to build each capability themselves.
Organizations should treat any web page that asks a user to run PowerShell or command-line steps as a likely scam and encourage employees to stop and report it rather than proceed. Security awareness efforts should specifically call out fake reCAPTCHA and Turnstile pages, since these mimic controls people are conditioned to trust. Because the associated malware is designed to try to disable antivirus and EDR tools after execution, quick reporting of suspicious activity is important, as delays can reduce detection and containment options. Web and marketing teams that manage WordPress sites are a relevant audience for this awareness effort, alongside helpdesk and IT support staff who may be first to hear about odd browser prompts from employees.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a lure where a fake verification or error page copies a malicious PowerShell command to the victim's clipboard and instructs them to paste and run it, which then executes malware.
The campaign began with compromised WordPress sites containing an obfuscated ErrTraffic JavaScript injection that rendered fake Google reCAPTCHA, Cloudflare Turnstile, or BSOD lures.
Follow-on stages used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary, with the loader also designed to try to kill antivirus and EDR processes.
It combines multiple malware-as-a-service products, delivery via compromised sites, social engineering, and defense evasion, rather than attackers building each capability themselves.
You land on a normal WordPress site and suddenly see a Google reCAPTCHA or Cloudflare Turnstile check that looks a little…off. This is a ClickFix campaign eSentire saw in July: a compromised site injects ErrTraffic JavaScript that pops a fake reCAPTCHA or even a Blue Screen of Death, then silently copies a PowerShell command to your clipboard and tells you to paste and run it to 'fix' the problem. If you run it, Cruciferra malware comes down, using Microsoft-signed binaries and a vulnerable driver to try to kill your antivirus and EDR before stealing data. The only reason it works is because the website talked you into running that clipboard PowerShell command. Your move: if any web page tells you to run PowerShell or command-line steps to verify or fix something, stop immediately and report the site to Security, do not paste or run that command.
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
