{"id":2678,"date":"2026-04-22T15:36:36","date_gmt":"2026-04-22T19:36:36","guid":{"rendered":"https:\/\/www.yorku.ca\/uit\/infosec\/?p=2678"},"modified":"2026-04-22T15:42:56","modified_gmt":"2026-04-22T19:42:56","slug":"fake-captcha-real-threat-clickfix-social-engineering-attacks","status":"publish","type":"post","link":"https:\/\/www.yorku.ca\/uit\/infosec\/2026\/04\/22\/fake-captcha-real-threat-clickfix-social-engineering-attacks\/","title":{"rendered":"Fake CAPTCHA, Real Threat: ClickFix Social Engineering Attacks"},"content":{"rendered":"\n

ClickFix attacks are a rapidly evolving threat that use fake CAPTCHA pages to trick people into running malicious commands (often PowerShell) on their own devices. In every ClickFix case, the attacker relies on one thing: your participation. Most traditional phishing attempts and malicious sites are filtered or blocked long before they reach you. That\u2019s why ClickFix pushes you to take extra steps yourself. By convincing you to run a command, the attacker gets past the protections already set in place and installs malware that would otherwise be detected.<\/p>\n\n\n\n

What is ClickFix?<\/h2>\n\n\n\n

ClickFix is a social engineering technique where attackers compromise legitimate websites and replace normal verification steps such as CAPTCHAs with fake prompts, and instruct users to run malicious commands on their computers. These commands often involve opening the Windows Run dialog or PowerShell and pasting in a script that appears to \u201cfix\u201d a problem or \u201cverify\u201d the user. In reality, the script is being used to download malware that compromises your device.<\/p>\n\n\n\n

This technique has been observed across higher\u2011education institutions and is increasingly used to deploy malware families such as CORNFLAKE.V3<\/a>, a backdoor capable of downloading additional payloads, collecting system information, and maintaining persistence on the device.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

How does it Work?<\/h2>\n\n\n\n

ClickFix attacks follow a simple pattern:<\/p>\n\n\n\n

    \n
  1. You click on a link from a search result or ad, and as the page loads, a strange-looking CAPTCHA <\/strong>or pop\u2011up appears unexpectedly.
    <\/li>\n\n\n\n
  2. Instead of asking you to click images or check a box, it tells you there\u2019s a \u201cproblem\u201d and you need to run a command<\/strong> to continue.
    <\/li>\n\n\n\n
  3. The page instructs you to open Windows + R<\/strong>, PowerShell, or Terminal and paste in a line of text<\/strong>.
    <\/li>\n\n\n\n
  4. That command silently downloads malware onto your device. In many cases, it installs a backdoor such as CORNFLAKE.V3<\/strong>, which can download additional malicious files onto your system, collect system information, and stay hidden on your machine.<\/li>\n<\/ol>\n\n\n\n

    Because the attacker convinces you<\/em> to run the command, your device treats it as a trusted action, making it much harder for security tools to block.<\/p>\n\n\n\n

    <\/div>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    How Can I Spot a ClickFix Attempt?<\/h2>\n\n\n\n

    Exercise caution towards any unfamiliar website, email, or popup that:<\/p>\n\n\n\n