ClickFix (fake CAPTCHA / Run-dialog paste)

ClickFix (also sold as fake-CAPTCHA kits) is social engineering that turns the user into the installer. A page shows a familiar ‘verify you are human’ prompt. JavaScript silently writes an attacker command to the clipboard — typically PowerShell using signed, built-in binaries (irm / iex and friends). The page then coaches Win+R, paste, Enter. Endpoint controls that only watch downloads and mail attachments miss the hand-off.

Why it lands: LOLBins, user-initiated execution, and UI that looks like Cloudflare or Google. Microsoft Threat Intelligence has documented ClickFix chains that continue into DLL sideloading, AD recon, and reverse tunnels. The U.S. FTC published a consumer warning on fake-CAPTCHA scams in June 2026. Kits now commoditise templates and rotating domains.

September 2026 lesson: third-party.com — a documentation placeholder used like example.com in W3C samples, Chromium docs, AI skills, and MCP integration guides — began serving a Windows-only ClickFix lure while returning a clean ‘OS not supported’ decoy to macOS/Linux and many scanners (Manifold Security / BleepingComputer, 23 Sep 2026). Reputation feeds that do not present a Windows desktop UA can mark the domain clean while the lure is live. Scrub third-party.com from internal docs and agent skills; prefer IANA reserved example.com / example.net / example.org.

Controls that hold: block clipboard-to-Run coaching domains where you can; alert on Win+R followed by powershell/cmd with irm, iex, curl|bash patterns; prefer AppLocker/WDAC over ‘users can run anything’; harden Helpdesk scripts so staff never ask users to paste verification commands. Hunt: new PowerShell with remote download cradles shortly after browser activity to CAPTCHA-lookalike hosts. Contain: isolate the host, rotate credentials used in that session, and check for follow-on persistence the vendor write-up names.

Put ClickFix next to malvertising, browser-extension supply chain, and device-code phishing in the IR playbook. Train once: we never paste a CAPTCHA ‘fix’ into Run, and documentation placeholders are not free hosting.