ScanMalware.com
Known malicious kitcriticalphishing

ClickFix FakeCAPTCHA — LOLBin variant (msiexec/mshta/wmic/etc.)

family: clickfix-fakecaptcha
Short link:scanmalware.com/h/139

Same fake-CAPTCHA flow as the PowerShell variant but the copied command is a non-PowerShell Windows LOLBin (msiexec /i <URL>, mshta, wmic, certutil, regsvr32, curl, iex, Invoke-Expression). First observed on 00c29c34fd.nxcli.io, reported to ThreatFox under the IClickFix tag. Markup-tolerant string matchers (<b>R</b> / <b>V</b> / <b>Enter</b>) catch kits whose instruction text is HTML-formatted.

Anchors

YARA ruleDetect_ClickFix_FakeCaptcha_LOLBin

Provenance

Added: 2026-05-27 10:49
YARA-anchored. Sister to the PowerShell rule under the same family slug.

Sightings (156)Atom feed

HostScanScriptMatchScanned
ath.pleh.orged3bd528…https://ath.pleh.org/captcha.txtyara2026-10-22 18:56
(inline)8046b8c9…(inline)yara2026-10-20 16:57
danabagroup.com#html8046b8c9…https://danabagroup.com#htmlyara2026-10-20 16:57
(inline)81da899e…(inline)yara2026-10-20 16:19
btorsercoyt31.cce871d0b5…https://btorsercoyt31.cc/js/all.min.jsyara2026-10-20 16:16
zurggoyttjof21.cce871d0b5…https://zurggoyttjof21.cc/js/all.min.jsyara2026-10-20 16:16
(inline)554461af…(inline)yara2026-10-20 16:07
morganaorvokki.com#html554461af…https://morganaorvokki.com#htmlyara2026-10-20 16:07
(inline)0e9e3898…(inline)yara2026-10-20 14:43
(inline)d0898d69…(inline)yara2026-10-20 00:20
(inline)1236cd1b…(inline)yara2026-10-18 17:47
(inline)b9b2c11b…(inline)yara2026-10-18 15:31
(inline)b9a68fe6…(inline)yara2026-10-17 17:34
(inline)f20c1aed…(inline)yara2026-10-17 17:27
(inline)5855bbf5…(inline)yara2026-10-17 17:14
www.website-256db78e.sct.lof.mybluehost.mecd6395f4…https://www.website-256db78e.sct.lof.mybluehost.me/#frame=2yara2026-10-16 11:40
(inline)e5ebcaa9…(inline)yara2026-10-16 11:40
sunnysingh.uk230eca31…https://sunnysingh.uk/wp-content/plugins/glitche-plugin/elementor/assets/js/front-end-widget.js?ver=7.1.3yara2026-10-16 11:37
sunnysingh.uk230eca31…https://sunnysingh.uk/#htmlyara2026-10-16 11:37
sunnysingh.uk230eca31…https://sunnysingh.uk/wp-content/uploads/elementor/google-fonts/css/roboto.css?ver=1753937273yara2026-10-16 11:37
sunnysingh.uk230eca31…https://sunnysingh.uk/yara2026-10-16 11:37
(inline)a55e4c97…(inline)yara2026-10-16 03:47
checkmybtrobot.cc824ab4f7…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-15 01:41
checkvbbrows39.ccb61aa060…https://checkvbbrows39.cc/js/all.min.jsyara2026-10-15 00:39
(inline)dc470e0d…(inline)yara2026-10-14 20:38
(inline)6605101c…(inline)yara2026-10-14 18:46
(inline)abee677d…(inline)yara2026-10-14 14:39
www.joseluislacasta.com#htmlabee677d…https://www.joseluislacasta.com#htmlyara2026-10-14 14:39
(inline)66002a26…(inline)yara2026-10-14 13:51
(inline)03f33c0e…(inline)yara2026-10-12 03:07
(inline)a649e5ba…(inline)yara2026-10-12 03:03
korowater.com#htmla649e5ba…https://korowater.com#htmlyara2026-10-12 03:03
austin-zhao.combb1447bd…https://austin-zhao.com/?cfcw_captcha_page=1#frame=1yara2026-10-12 02:04
austin-zhao.combb1447bd…https://austin-zhao.com/wp-content/plugins/full-box-export/captcha.html#frame=0yara2026-10-12 02:04
austin-zhao.combb1447bd…https://austin-zhao.com/?cfcw_captcha_page=1yara2026-10-12 02:04
austin-zhao.combb1447bd…https://austin-zhao.com/wp-content/plugins/full-box-export/captcha.htmlyara2026-10-12 02:04
narowalgymkhana.com7f91f624…https://narowalgymkhana.com/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:03
narowalgymkhana.com7f91f624…https://narowalgymkhana.com/?cfcw_captcha_page=1yara2026-10-12 02:03
productpalace.pke547df85…https://productpalace.pk/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:02
productpalace.pke547df85…https://productpalace.pk/?cfcw_captcha_page=1yara2026-10-12 02:02
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/wp-content/plugins/wp-security-optimizer/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 02:00
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:00
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/?cfcw_captcha_page=1yara2026-10-12 02:00
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/?cfcw_captcha_page=1#frame=1yara2026-10-12 01:58
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/wp-content/plugins/ads-custom-optimizer/captcha.html#frame=0yara2026-10-12 01:58
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/?cfcw_captcha_page=1yara2026-10-12 01:58
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/wp-content/plugins/ads-custom-optimizer/captcha.htmlyara2026-10-12 01:58
wealthywealth.co.za72d06720…https://wealthywealth.co.za/?cfcw_captcha_page=1#frame=0yara2026-10-12 01:58
wealthywealth.co.za72d06720…https://wealthywealth.co.za/?cfcw_captcha_page=1yara2026-10-12 01:58
verifiedbmsells.comc0f7c885…https://verifiedbmsells.com/?cfcw_captcha_page=1#frame=0yara2026-10-12 01:57
verifiedbmsells.comc0f7c885…https://verifiedbmsells.com/?cfcw_captcha_page=1yara2026-10-12 01:57
flutuarweb.com.br802a4f6b…https://flutuarweb.com.br/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:17
safestroutetransport.com74592d28…https://safestroutetransport.com/wp-content/plugins/ckk/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:16
movista.chc50a105a…https://movista.ch/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:15
zamzamksa.comb69287b7…https://zamzamksa.com/?cfcw_captcha_page=1#frame=1yara2026-10-12 00:12
zamzamksa.comb69287b7…https://zamzamksa.com/wp-content/plugins/visual-images/captcha.html#frame=0yara2026-10-12 00:12
zamzamksa.comb69287b7…https://zamzamksa.com/?cfcw_captcha_page=1yara2026-10-12 00:12
zamzamksa.comb69287b7…https://zamzamksa.com/wp-content/plugins/visual-images/captcha.htmlyara2026-10-12 00:12
www.rebatefirm.comc888a7c2…https://www.rebatefirm.com/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:09
www.professorpaulomoraes.com8869afff…https://www.professorpaulomoraes.com/wp-content/plugins/hcaptcha-and/captcha.html#frame=3yara2026-10-12 00:08
www.professorpaulomoraes.com8869afff…https://www.professorpaulomoraes.com/wp-content/plugins/hcaptcha-and/captcha.htmlyara2026-10-12 00:08
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/ckk/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:07
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/CF/captcha.html#frame=0yara2026-10-12 00:07
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/CF/captcha.htmlyara2026-10-12 00:07
(inline)de8ef3b1…(inline)yara2026-10-11 23:31
africanyoutharchitects.org#htmlde8ef3b1…https://africanyoutharchitects.org#htmlyara2026-10-11 23:31
christiancordero.mba#htmlfc6aa2c5…https://christiancordero.mba#htmlyara2026-10-11 22:59
(inline)48de73bd…(inline)yara2026-10-11 22:52
adamconsultings.com#html48de73bd…https://adamconsultings.com#htmlyara2026-10-11 22:52
checkmybtrobot.cc0cd70462…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-11 22:42
checkdvvc99.cccf615867…https://checkdvvc99.cc/js/all.min.jsyara2026-10-11 22:20
(inline)46142e9f…(inline)yara2026-10-11 20:48
(inline)95378547…(inline)yara2026-10-11 20:34
secretcrush.fun#html56458b66…https://secretcrush.fun#htmlyara2026-10-11 19:42
(inline)eef6f058…(inline)yara2026-10-11 19:25
(inline)9f9e3366…(inline)yara2026-10-11 18:31
actionawe.org#html6183a4d6…https://actionawe.org#htmlyara2026-10-11 18:27
(inline)f8364136…(inline)yara2026-10-11 18:26
bestsportsgearhub.com#html5b4fd32f…https://bestsportsgearhub.com#htmlyara2026-10-11 18:01
asm-app.com#html7e825756…https://asm-app.com#htmlyara2026-10-11 17:45
(inline)4c4b42f0…(inline)yara2026-10-11 16:00
(inline)e755ed8f…(inline)yara2026-10-11 11:19
checkdvvc99.cc06118274…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 20:34
checkmybtrobot.cc06118274…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 20:34
checkdvvc99.cc88dc2f17…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 17:02
checkmybtrobot.cc88dc2f17…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 17:02
(inline)3620701a…(inline)yara2026-10-09 16:52
(inline)c7ec5fd6…(inline)yara2026-10-09 16:15
blob:https://lesteredesdeprotecao.com.br/ef0b07c1-4a47-49b9-94c2-96c8d68cf10bc7ec5fd6…blob:https://lesteredesdeprotecao.com.br/ef0b07c1-4a47-49b9-94c2-96c8d68cf10byara2026-10-09 16:15
blob:https://lesteredesdeprotecao.com.br/33d11bcf-c74f-4375-9b38-a15beddb955fc7ec5fd6…blob:https://lesteredesdeprotecao.com.br/33d11bcf-c74f-4375-9b38-a15beddb955fyara2026-10-09 16:15
(inline)cab78076…(inline)yara2026-10-09 10:25
nicandle.ch54657bac…https://nicandle.ch/#htmlyara2026-10-09 10:25
(inline)64da7298…(inline)yara2026-10-09 09:53
(inline)89ec894e…(inline)yara2026-10-09 05:59
(inline)08d9f8d1…(inline)yara2026-10-09 04:33
checkmybtrobot.ccda8394f8…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 00:32
checkdvvc99.ccda8394f8…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 00:32
(inline)af088312…(inline)yara2026-10-08 23:46
(inline)7c42474d…(inline)yara2026-10-08 22:31
(inline)97f2a105…(inline)yara2026-10-08 19:46
(inline)fa6671a5…(inline)yara2026-10-08 17:06
(inline)ef711599…(inline)yara2026-10-08 14:21
(inline)817aa57d…(inline)yara2026-10-08 12:21
checkmybtrobot.cc47125f0f…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-08 12:19
checkdvvc99.cc47125f0f…https://checkdvvc99.cc/js/all.min.jsyara2026-10-08 12:19
tranquilacrestomahawk.com#htmlb0910aeb…https://tranquilacrestomahawk.com#htmlyara2026-10-08 12:19
vpn.reallstbank.ru2a288882…https://vpn.reallstbank.ru/#htmlyara2026-10-04 12:33
buh.reallstbank.ru21bd62a6…https://buh.reallstbank.ru/#htmlyara2026-10-04 12:33
cisco.parivpn.ru92b80206…https://cisco.parivpn.ru/#htmlyara2026-10-04 12:33
dms.cabinet-ingos.rudaaa841e…https://dms.cabinet-ingos.ru/#htmlyara2026-10-04 12:33
mx1.prod.rossko.sud6ff2dea…https://mx1.prod.rossko.su/#htmlyara2026-10-04 12:33
ai.parivpn.ru66a58636…https://ai.parivpn.ru/#htmlyara2026-10-04 12:33
alfastrahv.ru9849fa57…https://alfastrahv.ru/#htmlyara2026-10-04 12:33
niluhomeimprovement.comea7ccd42…https://niluhomeimprovement.com/#htmlyara2026-10-04 07:00
(inline)6e24e3ab…(inline)yara2026-10-04 04:25
(inline)d54cfa19…(inline)yara2026-10-04 04:25
(inline)18888b6c…(inline)yara2026-10-04 03:19
datahousemarketing.comafb9f1d1…https://datahousemarketing.com/#htmlyara2026-10-01 19:20
acmaturaky.cz76f6d43b…https://acmaturaky.cz/#htmlyara2026-10-01 19:15
niluhomeimprovement.com539be8c1…https://niluhomeimprovement.com/#htmlyara2026-10-01 19:15
interseq.at44cdc9a4…https://interseq.at/MyTest1109/apiyara2026-09-23 13:18
sportsministry.info#htmla4d1d61d…https://sportsministry.info#htmlyara2026-09-23 02:47
bassprosurvey.storefcbeb0c6…https://bassprosurvey.store/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-23 01:47
checkrobotbb.pw7a4aadbf…https://checkrobotbb.pw/js/all.min.jsyara2026-09-22 12:41
www.hyundaiservisiankara.com#htmlc7fe6f64…https://www.hyundaiservisiankara.com#htmlyara2026-09-22 11:26
inwiththewoods.com#htmlb3c6fbf9…https://inwiththewoods.com#htmlyara2026-09-22 11:26
inwiththewoods.com#html2c5baae6…https://inwiththewoods.com#htmlyara2026-09-22 01:47
mepi.com.sa474be3e3…https://mepi.com.sa/wp-content/litespeed/js/361652a8a3ea8158882d51388f4b8798.js?ver=b8798yara2026-09-21 23:47
www.hyundaiservisiankara.com#html718ef51e…https://www.hyundaiservisiankara.com#htmlyara2026-09-21 01:47
squidscript.com#html42850179…https://squidscript.com#htmlyara2026-09-21 01:47
fundingfactors.com#html2780752e…https://fundingfactors.com#htmlyara2026-09-20 05:47
interseq.at4e36e012…https://interseq.at/potok_1/api?ver=3.2.1yara2026-09-19 15:47
interseq.ata1a1b143…https://interseq.at/lom2/api?ver=1.0.0yara2026-09-19 03:47
agenciadetraduccion.netfa8c25ab…https://agenciadetraduccion.net/wp-content/plugins/safe-rss/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-19 02:47
www.rebatefirm.com8793785d…https://www.rebatefirm.com/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-18 22:47
harapouya.ir#html4af84455…https://harapouya.ir#htmlyara2026-09-18 15:47
tedxamsterdamed.nl#html85318545…https://tedxamsterdamed.nl#htmlyara2026-09-18 02:47
oemselect.com#html027d64fa…https://oemselect.com#htmlyara2026-09-17 05:47
(inline)9b635933…(inline)yara2026-09-16 15:47
enerjplus.com#html979e0b11…https://enerjplus.com#htmlyara2026-09-16 08:47
amjadworld.com#htmld4e9d1eb…https://amjadworld.com#htmlyara2026-09-15 02:47
botcheck-cf.top5d371917…https://botcheck-cf.top/js/all.min.jsyara2026-09-14 21:47
garden-sugizo.com#htmla9c903d4…https://garden-sugizo.com#htmlyara2026-09-14 17:47
eesa.surf#html8bbb284c…https://eesa.surf#htmlyara2026-09-14 11:47
checkbot-cf.site2c1a021f…https://checkbot-cf.site/js/all.min.jsyara2026-09-14 04:47
cf-check.site2c1a021f…https://cf-check.site/js/all.min.jsyara2026-09-14 04:47
thamyresheros.com52c96b74…https://thamyresheros.com/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-14 02:47
riadlallajihane.com#htmlb2a5e9e8…https://riadlallajihane.com#htmlyara2026-09-13 02:47
hakverdi.net#html18688c23…https://hakverdi.net#htmlyara2026-09-13 01:47
norediam.comca791ac9…https://norediam.com/traffic/apiyara2026-08-26 12:40
norediam.com444ecfbf…https://norediam.com/traffic/apiyara2026-08-26 11:19
norediam.coma7182413…https://norediam.com/traffic/apiyara2026-08-26 07:19
gangesjute.come33f85f1…https://gangesjute.com/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-08-15 03:08
00c29c34fd.nxcli.iof6c071f8…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:41
00c29c34fd.nxcli.io2f465516…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:29
00c29c34fd.nxcli.io52b189eb…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:17