A recent research by SlashNext says the technique, called ClickFix tricks users into running commands that deploy malware. ClickFix shows a fake version of Cloudflare’s Turnstile CAPTCHA page. It replicates visual layout and technical elements like Ray ID identifier to look authentic.
Prompt that users generally miss
The phishing site is hosted on a domain that looks like the real one, or an authentic website that has been attacked. When users visit the site, they are tricked into checking a box called “Verify you are human.”
This step looks normal and doesn’t raise any suspicion but after this, the users are asked to run a series of commands such as “Win + R” then “Ctrl + V” and after that “Enter.” These steps look harmless but they use a PowerShell command. Once executed, it can extract malware such as Lumma, NetSupport Manager, and Stealc.
According to security expert Daniel Kelley, “ClickFix is a social engineering attack that tricks users into running malicious commands on their own devices – all under the guise of a routine security check.” ClickFix is dangerous because it uses standard security measures as attack tools.
Experts call this “verification fatigue,” where a user clicks through various prompts without proper investigation. "In the context of a familiar-looking Cloudflare page, a user often assumes these extra steps are normal, especially if they’re in a hurry to reach some content. The instructions to press Win+R and Ctrl+V may raise an eyebrow for tech-savvy people, but an average user – seeing official logos and not understanding the implications – can be socially engineered into treating it as an advanced CAPTCHA," Slash reported in the blog.
This tactic doesn't depend on exploiting software flaws, it exploits trust and user habits.
The phishing page is sent as a single HTML file but includes embedded scripts and hidden code to perform clipboard injections.
It uses genuine Windows utilities and doesn't download executables so that it can escape traditional identification tools. General defenses such as endpoint protection or antivirus software usually aim to detect binaries or suspicious downloads.
In this incident, users were baited into activating the threat themselves. This underscores the need for sophisticated malware protection with zero-hour defense that can detect clipboard injections and malicious CAPTCHA screens in real-time.
