Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill antivirus and EDR processes, increasing the chance the infection succeeds.
This campaign, tracked by eSentire, relied on compromised WordPress sites rather than phishing emails. An obfuscated ErrTraffic JavaScript injection on these sites resolved a command-and-control address before retrieving JavaScript for a fake Google reCAPTCHA, Cloudflare Turnstile, or Blue Screen of Death (BSOD) lure. The lure copied a malicious PowerShell command to the victim's clipboard and instructed them to paste and run it, a technique commonly known as ClickFix.
Once executed, the command triggered follow-on stages that used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary. The activity was associated with the Cruciferra loader, which is marketed on underground forums as capable of killing antivirus and endpoint detection and response (EDR) processes, including through a vulnerable driver.
The attack succeeded because it exploited trust in familiar web verification steps rather than a suspicious email or link. Fake reCAPTCHA and Turnstile prompts look routine to most users, so a request to "verify" by running a command can seem plausible in the moment. The use of Microsoft-signed binaries for sideloading also helped the malware blend in with legitimate system activity, reducing the chance of early detection.
This case also illustrates how attackers can combine multiple malware-as-a-service products, delivery, social engineering, and defense evasion, without needing to build each capability themselves.
Organizations should treat any web page that asks a user to run PowerShell or command-line steps as a likely scam and encourage employees to stop and report it rather than proceed. Security awareness efforts should specifically call out fake reCAPTCHA and Turnstile pages, since these mimic controls people are conditioned to trust. Because the associated malware is designed to try to disable antivirus and EDR tools after execution, quick reporting of suspicious activity is important, as delays can reduce detection and containment options. Web and marketing teams that manage WordPress sites are a relevant audience for this awareness effort, alongside helpdesk and IT support staff who may be first to hear about odd browser prompts from employees.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a lure where a fake verification or error page copies a malicious PowerShell command to the victim's clipboard and instructs them to paste and run it, which then executes malware.
The campaign began with compromised WordPress sites containing an obfuscated ErrTraffic JavaScript injection that rendered fake Google reCAPTCHA, Cloudflare Turnstile, or BSOD lures.
Follow-on stages used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary, with the loader also designed to try to kill antivirus and EDR processes.
It combines multiple malware-as-a-service products, delivery via compromised sites, social engineering, and defense evasion, rather than attackers building each capability themselves.
You land on a normal WordPress site and suddenly see a Google reCAPTCHA or Cloudflare Turnstile check that looks a little…off. This is a ClickFix campaign eSentire saw in July: a compromised site injects ErrTraffic JavaScript that pops a fake reCAPTCHA or even a Blue Screen of Death, then silently copies a PowerShell command to your clipboard and tells you to paste and run it to 'fix' the problem. If you run it, Cruciferra malware comes down, using Microsoft-signed binaries and a vulnerable driver to try to kill your antivirus and EDR before stealing data. The only reason it works is because the website talked you into running that clipboard PowerShell command. Your move: if any web page tells you to run PowerShell or command-line steps to verify or fix something, stop immediately and report the site to Security, do not paste or run that command.
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Researchers found a real phishing campaign abusing npm packages and unpkg mirrors to host a convincing fake Cloudflare CAPTCHA page on a trusted domain. Victims who click the mirrored link are redirected to attacker-controlled infrastructure that could deliver ClickFix-style prompts or credential…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
