ClickFix Attack
O que é ClickFix Attack?
ClickFix AttackA 2024-vintage social-engineering lure that displays a fake CAPTCHA, error dialog, or 'verify you're human' page instructing the victim to paste a pre-copied PowerShell command into Run, delivering info-stealers or loaders.
ClickFix is a social-engineering pattern that exploded in 2024 and remained one of the most common initial-access vectors in 2025–2026 stealer campaigns. The victim lands on a compromised or attacker-controlled page that mimics a CAPTCHA challenge, a Microsoft/Cloudflare verification prompt, or a 'fix the document loading error' dialog. The page silently writes a long, obfuscated PowerShell or `mshta` command to the clipboard and asks the victim to press Win+R, paste, and press Enter to 'complete verification' or 'apply the fix'. Because the user types the command themselves, no exploit, macro, or signed payload is required — endpoint controls relying on browser exploitation or office-macro telemetry miss it entirely. Documented payloads include Lumma Stealer, DarkGate, Vidar, Atomic Stealer (macOS variants), AsyncRAT, and SocGholish loaders. Defenses combine user training on never pasting commands into Run, attack-surface reduction rules blocking PowerShell/mshta launched from Explorer, and EDR telemetry on suspicious clipboard-sourced PowerShell.
● Exemplos
- 01
A compromised news site shows a 'I'm not a robot — verify' dialog that copies a base64-PowerShell command and instructs the user to paste it into Win+R; the command downloads Lumma Stealer.
- 02
A macOS variant tells the user to paste a Terminal command 'to fix screen-share permissions,' delivering Atomic Stealer.
● Perguntas frequentes
O que é ClickFix Attack?
A 2024-vintage social-engineering lure that displays a fake CAPTCHA, error dialog, or 'verify you're human' page instructing the victim to paste a pre-copied PowerShell command into Run, delivering info-stealers or loaders. Pertence à categoria Ataques e ameaças da cibersegurança.
O que significa ClickFix Attack?
A 2024-vintage social-engineering lure that displays a fake CAPTCHA, error dialog, or 'verify you're human' page instructing the victim to paste a pre-copied PowerShell command into Run, delivering info-stealers or loaders.
Como funciona ClickFix Attack?
ClickFix is a social-engineering pattern that exploded in 2024 and remained one of the most common initial-access vectors in 2025–2026 stealer campaigns. The victim lands on a compromised or attacker-controlled page that mimics a CAPTCHA challenge, a Microsoft/Cloudflare verification prompt, or a 'fix the document loading error' dialog. The page silently writes a long, obfuscated PowerShell or `mshta` command to the clipboard and asks the victim to press Win+R, paste, and press Enter to 'complete verification' or 'apply the fix'. Because the user types the command themselves, no exploit, macro, or signed payload is required — endpoint controls relying on browser exploitation or office-macro telemetry miss it entirely. Documented payloads include Lumma Stealer, DarkGate, Vidar, Atomic Stealer (macOS variants), AsyncRAT, and SocGholish loaders. Defenses combine user training on never pasting commands into Run, attack-surface reduction rules blocking PowerShell/mshta launched from Explorer, and EDR telemetry on suspicious clipboard-sourced PowerShell.
Como se defender contra ClickFix Attack?
As defesas contra ClickFix Attack costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para ClickFix Attack?
Nomes alternativos comuns: Paste-and-run lure, Fake CAPTCHA attack.
● Termos relacionados
- attacks№ 1182
Engenharia social
Manipulação psicológica que leva pessoas a executar ações ou a revelar informações confidenciais em benefício do atacante.
- attacks№ 398
Download drive-by
Ataque em que malware é instalado silenciosamente no dispositivo da vítima simplesmente por visitar um site comprometido ou malicioso.
- malware№ 591
Info stealer
Malware que recolhe credenciais, cookies, tokens, carteiras de cripto e outros dados sensíveis do dispositivo infetado e os exfiltra para o atacante.
- malware№ 708
Lumma Stealer
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
- malware№ 1181
SocGholish
A JavaScript-based fake-browser-update loader operated by TA569, served from thousands of compromised WordPress sites and used as the initial-access stage for ransomware affiliates including Evil Corp and BlackCat.
- attacks№ 720
Malvertising
Uso de redes de publicidade online para distribuir malware, exploits ou esquemas através de anúncios aparentemente legítimos em sites de confiança.
● Veja também
- № 1390XWorm