ClickFix Fake CAPTCHA Script Execution via Browser-Spawned Interpreter

Ethan Andrews@eandrews

•updated Jun 24, 2026•4•0•5

Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.