ClickFix PowerShell clipboard download-and-execute (vcapcha.ps1)

Duo Tech@duotech

•updated Aug 18, 2026•8•0•21

Detects the StopAndProtect ClickFix lure: a fake CAPTCHA/human-verification page tricks victims into pasting and running a clipboard-staged PowerShell command (Win+R, Ctrl+V, Enter) that downloads and runs vcapcha.ps1.