Most Significant TTP 2026: Automotive-Themed Fake CAPTCHA Lure Referrer Precedin

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•0

Detects a potential ClickFix delivery attack where a user navigates to an automotive-themed website, interacts with the system via the Windows Run dialog (RunMRU), and subsequently executes command-line interpreters (powershell, cmd, wscript, mshta) spawned by explorer.exe within a short time window.