API-Driven ClickFix Campaigns and Stealthy Execution Techniques

ClickFix has evolved into a sophisticated initial access technique, seeing a 517% increase in adoption between late 2024 and 2025. The attack exploits human trust in CAPTCHA challenges by using malicious JavaScript to inject commands into the system clipboard, which victims then manually execute. This technique is now used by high-profile threat actors including APT28, MuddyWater, and Kimsuky for delivering various malware families like ClearFake and Infostealers.

Technical analysis reveals a shift toward ClickFix Payload-as-a-Service (CPaaS), where backend API servers generate unique, multi-layered obfuscated payloads for every request to evade static detection. Furthermore, attackers are moving away from the standard Windows+R (Run Dialog) method to Windows+X (Terminal) execution to avoid leaving traces in the RunMRU registry key and to appear more legitimate to system administrators.

A new 'Downloads-folder' variant has also emerged, where a harmless orchestrator command is pasted to move and execute a payload previously downloaded to the user's Downloads directory. This effectively bypasses AMSI by ensuring the malicious code is not directly contained within the command line executed from the clipboard. Organizations should prioritize behavioral detections for unusual process lineages involving explorer.exe and WindowsTerminal.exe.