Known malicious kitcriticalphishing
ClickFix FakeCAPTCHA — PowerShell variant
family: clickfix-fakecaptcha
Fake-CAPTCHA HTML page that copies a `powershell -enc <base64>` command to clipboard for the victim to paste into Win+R. Social-engineering pretext: "Verify you are human" / "Not a robot" / "Verification Steps" / "Press Windows Key + R / Ctrl + V / Enter". YARA rule reports 283 samples matched, >60% zero AV detection at time of analysis.
Anchors
YARA ruleDetect_ClickFix_FakeCaptcha_PowerShell
Provenance
Added: 2026-05-27 10:49
Anchored on a YARA rule over the page HTML: the kit lives in the HTML body and inline <script>, with no separate script file to fingerprint.