ClickFix Infostealer Spreads via Fake CAPTCHA Traps, Targeting Unsuspecting Users
A new wave of the ClickFix Infostealer campaign that abuses fake CAPTCHA pages to deliver credential-stealing malware.
Initially detected through late-stage Endpoint Detection and Response (EDR) alerts, the campaign shows strong similarities to the ClickFix operation targeting restaurant reservation systems in July 2025, as highlighted in BlueVoyant’s earlier research.
Further correlation with recent threat telemetry suggests that this campaign is part of a broader distribution network leveraging “human verification” decoys to deliver infostealers.
The identified ClickFix variant focuses on reconnaissance, system profiling, and large-scale data exfiltration. Before launching its theft routines, it validates whether the environment is virtualized and checks for endpoint protection tools.
The malware then extracts sensitive information, including browser credentials, cryptocurrency wallet data, VPN configuration files, and gaming application logins such as Steam.
On January 23, 2026, CyberProof analysts identified multiple EDR alerts triggered by clipboard access through the CClipDataObject::GetData API, followed by a suspicious PowerShell execution.
The attack chain begins when victims visit a compromised webpage containing a fake CAPTCHA challenge.
Once the user interacts with the CAPTCHA element, a PowerShell command runs from memory and fetches content from the attacker-controlled IP address 91.92.240.219.
This script initiates a multi-stage infection process, downloading an additional payload from 178.16.53.70, and later fetching cptch.bin a position-independent shellcode compiled with Donut, a tool often used to load .NET payloads directly in memory.
Defender for Endpoint identified and named the suspicious chain as Behavior: Win32/SuspClickFix.C, highlighting a potential OpSec error by the threat actor when leaving the variable $finalPayload visible in the command line.
The subsequent payload hosted on 94.154.35.115 communicates with the command-and-control server to fetch other components, such as cptchbuild.bin, which appeared to be a modified loader hosted on the same infrastructure.
During execution, the malware allocates memory within legitimate processes like svchost.exe using APIs such as VirtualAlloc and CreateThread.
This process injection improves stealth and allows the malware to conduct systemwide data collection unseen by user-level antivirus tools.
To maintain persistence, the ClickFix attack infostealer modifies the RunMRU registry key, causing Windows to execute a PowerShell redeployment script at startup.
This ensures the malware remains active after reboot and re-establishes communication with the attacker’s infrastructure.
Once active, the malware performs credential and data theft across multiple platforms:
Network telemetry and proxy logs confirmed connections to fake CAPTCHA landing pages used as initial infection vectors, aligning with similar ClickFix lures analyzed in R.D. Tarun’s February 2026 research.
The latest ClickFix iteration demonstrates the evolving effectiveness of social engineering tactics paired with advanced in-memory execution techniques.
The use of fake CAPTCHA prompts highlights how attackers exploit familiar web elements to persuade users into executing malicious scripts.
Security teams are advised to monitor PowerShell network connections to the listed IPs and inspect registry modifications for abnormal RunMRU entries to help prevent reinfection cycles.
| Type | Value |
|---|---|
| IP Address | 94.154.35.115 |
| IP Address | 91.92.240.219 |
| IP Address | 178.16.53.70 |
| Domain | pinmaha.com |
| MD5 Hash | fe4a3fb1a48bbdea986e05d1459f925e |
| MD5 Hash | f50846dcf09e0c7ce582040fb128ebf3 |
| MD5 Hash | a3cff7d2ef600d58bca156de0b299d88 |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…