New ClickFix attack Hides in Native Windows Tools to Reduce Detection Risk
ClickFix campaign uses fake CAPTCHA to trick Windows users into running malicious commands via cmdkey and regsvr32.
A new ClickFix social engineering campaign discovered by CyberProof tricks users into executing malicious commands through fake CAPTCHA pages, leveraging native Windows tools (cmdkey and regsvr32) to maintain persistence and evade detection. The attack chains multiple actions to fetch a malicious DLL (demo.dll) from a remote server, which establishes scheduled tasks retrieving instructions from a remote XML file. By using trusted Windows binaries (LOLBins) and avoiding obvious malware detection signatures, attackers achieve high stealth while maintaining execution reliability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ClickFix attack demonstrates how cybercriminals exploit user trust through fake CAPTCHA pages to trick victims into executing malicious commands. By leveraging legitimate Windows tools like cmdkey and regsvr32 (Living-off-the-Land binaries), attackers achieve persistence while evading traditional security detection mechanisms. This technique highlights the critical importance of user education and proper system configuration to prevent social engineering attacks that abuse trusted system components.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 151.245.195.142
- malware — demo.dll
- malware — ClickFix