ClickFix Infostealer Campaign Uses Fake CAPTCHA Lures to Compromise Victims
A new malware campaign has been identified, utilizing fake CAPTCHA lures to deceive users and deploy an advanced information stealer. This campaign, detected in early 2026, exhibits similarities with the ClickFix campaign that targeted restaurant…
A new malware campaign has been identified, utilizing fake CAPTCHA lures to deceive users and deploy an advanced information stealer. This campaign, detected in early 2026, exhibits similarities with the ClickFix campaign that targeted restaurant reservation systems in Jul 2025.
The operators of this campaign have enhanced their social engineering tactics to effectively bypass traditional security controls and gain initial access to victim systems. The attack begins when a user visits a compromised website that displays a misleading CAPTCHA verification page. This page prompts the victim to copy a malicious PowerShell command to their clipboard and execute it manually, bypassing automated security sandboxes.
The command initiates a download from the attacker's infrastructure, specifically the IP 91.92.240.219. The malware reads the clipboard via specific API calls to verify the user's action before proceeding. Once executed, the malicious script begins a multi-stage infection process designed to steal sensitive data from various applications, including over twenty-five web browsers, cryptocurrency wallets like MetaMask, and enterprise VPN configurations.
A new malware campaign has been identified, utilizing fake CAPTCHA lures to deceive users and deploy an advanced information stealer.
The malware employs advanced process injection techniques to maintain stealth on infected devices. Following the initial PowerShell execution, it downloads a position-independent shellcode file named cptch.bin from the attacker's infrastructure. This shellcode allocates memory within benign processes like svchost.exe using standard Windows APIs such as VirtualAlloc to conceal its malicious activity.
To ensure persistence, the attackers modify the RunMRU registry key to re-execute the malicious PowerShell command upon startup, re-initiating the payload download. Additionally, the actors rotate payload filenames, such as cptchbuild.bin , to bypass hash-based blocking mechanisms.
Organizations should educate users about the risks associated with executing commands from web pages. Security teams are advised to monitor for unusual PowerShell execution and specific registry modifications. Implementing endpoint detection rules that flag clipboard data reading by browser processes can aid in early detection of this attack.
Based on reporting by Cyber Security News.