Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill antivirus and EDR processes, increasing the chance the infection succeeds.
This campaign, tracked by eSentire, relied on compromised WordPress sites rather than phishing emails. An obfuscated ErrTraffic JavaScript injection on these sites resolved a command-and-control address before retrieving JavaScript for a fake Google reCAPTCHA, Cloudflare Turnstile, or Blue Screen of Death (BSOD) lure. The lure copied a malicious PowerShell command to the victim's clipboard and instructed them to paste and run it, a technique commonly known as ClickFix.
Once executed, the command triggered follow-on stages that used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary. The activity was associated with the Cruciferra loader, which is marketed on underground forums as capable of killing antivirus and endpoint detection and response (EDR) processes, including through a vulnerable driver.
The attack succeeded because it exploited trust in familiar web verification steps rather than a suspicious email or link. Fake reCAPTCHA and Turnstile prompts look routine to most users, so a request to "verify" by running a command can seem plausible in the moment. The use of Microsoft-signed binaries for sideloading also helped the malware blend in with legitimate system activity, reducing the chance of early detection.
This case also illustrates how attackers can combine multiple malware-as-a-service products, delivery, social engineering, and defense evasion, without needing to build each capability themselves.
Organizations should treat any web page that asks a user to run PowerShell or command-line steps as a likely scam and encourage employees to stop and report it rather than proceed. Security awareness efforts should specifically call out fake reCAPTCHA and Turnstile pages, since these mimic controls people are conditioned to trust. Because the associated malware is designed to try to disable antivirus and EDR tools after execution, quick reporting of suspicious activity is important, as delays can reduce detection and containment options. Web and marketing teams that manage WordPress sites are a relevant audience for this awareness effort, alongside helpdesk and IT support staff who may be first to hear about odd browser prompts from employees.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a lure where a fake verification or error page copies a malicious PowerShell command to the victim's clipboard and instructs them to paste and run it, which then executes malware.
The campaign began with compromised WordPress sites containing an obfuscated ErrTraffic JavaScript injection that rendered fake Google reCAPTCHA, Cloudflare Turnstile, or BSOD lures.
Follow-on stages used Microsoft-signed binaries for DLL sideloading and injected an information stealer into another signed binary, with the loader also designed to try to kill antivirus and EDR processes.
It combines multiple malware-as-a-service products, delivery via compromised sites, social engineering, and defense evasion, rather than attackers building each capability themselves.
You land on a normal WordPress site and suddenly see a Google reCAPTCHA or Cloudflare Turnstile check that looks a little…off. This is a ClickFix campaign eSentire saw in July: a compromised site injects ErrTraffic JavaScript that pops a fake reCAPTCHA or even a Blue Screen of Death, then silently copies a PowerShell command to your clipboard and tells you to paste and run it to 'fix' the problem. If you run it, Cruciferra malware comes down, using Microsoft-signed binaries and a vulnerable driver to try to kill your antivirus and EDR before stealing data. The only reason it works is because the website talked you into running that clipboard PowerShell command. Your move: if any web page tells you to run PowerShell or command-line steps to verify or fix something, stop immediately and report the site to Security, do not paste or run that command.
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
