Known malicious kithighphishing
ClickFix cache smuggling: 'open the verification dialog' Run-dialog steps — screenshot text
family: clickfix-cache-smuggling-2026-10
Short link:scanmalware.com/h/261
The overlay Microsoft Threat Intelligence published on 2026-10-03 is a Cloudflare-style box ('Verifying…', 'Let us know you're human, please complete steps') with three numbered steps: press Windows key + R 'to open the verification dialog', press Ctrl + V 'to paste the confirmation code', and press Enter 'to confirm you're not a robot', followed by a Ref ID. The wording calls the Run dialog a 'verification dialog' and the copied command a 'confirmation code'. No legitimate verification step asks visitors to open the Run dialog.
Anchors
SMQL queryrun
ocr:"open the verification dialog" OR ocr:"paste the confirmation code"Provenance
Added: 2026-10-04 13:07
Matches pages whose screenshot shows either of the two step phrases, whatever the page code looks like, so it also catches overlays whose script is packed or loaded from another server. The heading 'Let us know you're human' is not used as an anchor, because a widely used commercial press-and-hold bot check shows the same words. Other ClickFix kits may reuse the step wording with a different command, and an article that reproduces a screenshot of the lure can also match. Microsoft has not named the operator. The campaign shares its browser-cache first step and its later-stage behaviour with the DOUBLECUP ClickFix delivery service and its CountLoader payload (SOCRadar, August 2026); that is an overlap, not a confirmed attribution.
Sightings (0)Atom feed
No sightings recorded yet.