{"id":59236,"date":"2025-08-22T15:37:54","date_gmt":"2025-08-22T15:37:54","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/fake-captcha-tests-trick-users-into-running-malware\/"},"modified":"2025-08-22T15:37:54","modified_gmt":"2025-08-22T15:37:54","slug":"fake-captcha-tests-trick-users-into-running-malware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fake-captcha-tests-trick-users-into-running-malware\/","title":{"rendered":"Fake CAPTCHA tests trick users into running malware"},"content":{"rendered":"

Microsoft’s security team has published an in-depth report into ClickFix, the social engineering attack which tricks users into executing malicious commands in the guise of proving their humanity.<\/p>\n

ClickFix pretends to be a standard CAPTCHA challenge. But, instead of clicking squares with motorbikes in them, sliding a puzzle-piece into place, or rotating increasingly-bizarre objects to particular orientations, it demands that users do something . . . else.<\/p>\n

The fake CAPTCHA tells them to hit the Windows\/Super key and R, then Control and V followed by Enter \u2013 a combination which, any reader who’s used a computer for more than a week or so will likely recognize, opens up the Windows Run prompt, pastes whatever the attacker placed in the clipboard, and executes it. Imagine users smiling to themselves as they do this, thinking of how helpful they are being while crooks are helping themselves to unauthorized access.<\/p>\n

\"hotel\"<\/p>\n

That ‘angry guest’ email from Booking.com? It’s a scam, not a 1-star review<\/h2>\n

READ MORE<\/span><\/a><\/div>\n

“Over the past year,” the research team wrote of its findings<\/a>, “Microsoft Threat Intelligence and Microsoft Defender Experts have observed the ClickFix social engineering technique growing in popularity, with campaigns targeting thousands of enterprise and end-user devices globally every day.”<\/p>\n

Miscreants most famously used the ClickFix technique during a recent phishing campaign against Booking.com users<\/a>. The attackers sent malicious emails to hospitality vendors with claims of negative reviews or customer queries, but when victims clicked through, they were taken to an attacker-controlled site which had a fake CAPTCHA test.<\/p>\n