What it is
ClickFix campaigns hijack legitimate sites or operate on lookalike landing pages. A fake reCAPTCHA/Cloudflare widget instructs the user to press Windows+R and paste an attacker-supplied command that downloads and executes a loader (often Lumma, AsyncRAT, or NetSupport). Because the malicious payload is run by the user themselves in their own shell, web filters and EDR solutions frequently miss it.
Real-world examples
- Fake reCAPTCHA leading to Lumma Stealer in 2024–2025.
- Compromised WordPress sites serving a 'Verify you are human' overlay.
How ExploitShield detects it
ExploitShield's headless browser recognizes the lure DOM pattern and flags the iframe initiator chain, the clipboard.writeText() call, and the C2 domain — turning a user-dependent attack into an actionable evidence trail before another visitor reaches the page.