ScanMalware.com
Known malicious kitcriticalphishing

ClickFix FakeCAPTCHA — PowerShell variant

family: clickfix-fakecaptcha
Short link:scanmalware.com/h/138

Fake-CAPTCHA HTML page that copies a `powershell -enc <base64>` command to clipboard for the victim to paste into Win+R. Social-engineering pretext: "Verify you are human" / "Not a robot" / "Verification Steps" / "Press Windows Key + R / Ctrl + V / Enter". YARA rule reports 283 samples matched, >60% zero AV detection at time of analysis.

Anchors

YARA ruleDetect_ClickFix_FakeCaptcha_PowerShell

Provenance

Added: 2026-05-27 10:49
Anchored on a YARA rule over the page HTML: the kit lives in the HTML body and inline <script>, with no separate script file to fingerprint.

Sightings (13)Atom feed

HostScanScriptMatchScanned
wage-britannica-indicated-qualifying.trycloudflare.com5f3340d9…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.html#htmlyara2026-10-17 10:59
wage-britannica-indicated-qualifying.trycloudflare.com5f3340d9…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.htmlyara2026-10-17 10:59
wage-britannica-indicated-qualifying.trycloudflare.com8acd9df7…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.html#htmlyara2026-10-17 10:39
wage-britannica-indicated-qualifying.trycloudflare.com8acd9df7…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.htmlyara2026-10-17 10:39
wage-britannica-indicated-qualifying.trycloudflare.com3a6199f7…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.html#htmlyara2026-10-17 10:30
wage-britannica-indicated-qualifying.trycloudflare.com3a6199f7…https://wage-britannica-indicated-qualifying.trycloudflare.com/activity.htmlyara2026-10-17 10:30
wage-britannica-indicated-qualifying.trycloudflare.com23b8ec3f…https://wage-britannica-indicated-qualifying.trycloudflare.com/#htmlyara2026-10-17 08:39
wage-britannica-indicated-qualifying.trycloudflare.com23b8ec3f…https://wage-britannica-indicated-qualifying.trycloudflare.com/yara2026-10-17 08:39
wage-britannica-indicated-qualifying.trycloudflare.com00423c8c…https://wage-britannica-indicated-qualifying.trycloudflare.com/#htmlyara2026-10-16 06:56
wage-britannica-indicated-qualifying.trycloudflare.com00423c8c…https://wage-britannica-indicated-qualifying.trycloudflare.com/yara2026-10-16 06:56
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/wp-content/plugins/wp-security-optimizer/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 02:00
inwiththewoods.com#htmlb3c6fbf9…https://inwiththewoods.com#htmlyara2026-09-22 11:26
inwiththewoods.com#html2c5baae6…https://inwiththewoods.com#htmlyara2026-09-22 01:47