ScanMalware.com
Known malicious kitcriticalphishing

ClickFix FakeCAPTCHA — LOLBin variant (msiexec/mshta/wmic/etc.)

family: clickfix-fakecaptcha
Short link:scanmalware.com/h/139

Same fake-CAPTCHA flow as the PowerShell variant but the copied command is a non-PowerShell Windows LOLBin (msiexec /i <URL>, mshta, wmic, certutil, regsvr32, curl, iex, Invoke-Expression). First observed on 00c29c34fd.nxcli.io, reported to ThreatFox under the IClickFix tag. Markup-tolerant string matchers (<b>R</b> / <b>V</b> / <b>Enter</b>) catch kits whose instruction text is HTML-formatted.

Anchors

YARA ruleDetect_ClickFix_FakeCaptcha_LOLBin

Provenance

Added: 2026-05-27 10:49
YARA-anchored. Sister to the PowerShell rule under the same family slug.

Sightings (134)

HostScanScriptMatchWhen
checkmybtrobot.cc824ab4f7…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-15 01:44
checkvbbrows39.ccb61aa060…https://checkvbbrows39.cc/js/all.min.jsyara2026-10-15 00:41
(inline)dc470e0d…(inline)yara2026-10-14 20:40
(inline)6605101c…(inline)yara2026-10-14 18:47
(inline)abee677d…(inline)yara2026-10-14 14:40
www.joseluislacasta.com#htmlabee677d…https://www.joseluislacasta.com#htmlyara2026-10-14 14:40
(inline)66002a26…(inline)yara2026-10-14 13:53
(inline)03f33c0e…(inline)yara2026-10-12 03:09
(inline)a649e5ba…(inline)yara2026-10-12 03:04
korowater.com#htmla649e5ba…https://korowater.com#htmlyara2026-10-12 03:04
austin-zhao.combb1447bd…https://austin-zhao.com/wp-content/plugins/full-box-export/captcha.html#frame=0yara2026-10-12 02:05
austin-zhao.combb1447bd…https://austin-zhao.com/?cfcw_captcha_page=1#frame=1yara2026-10-12 02:05
narowalgymkhana.com7f91f624…https://narowalgymkhana.com/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:04
austin-zhao.combb1447bd…https://austin-zhao.com/?cfcw_captcha_page=1yara2026-10-12 02:04
austin-zhao.combb1447bd…https://austin-zhao.com/wp-content/plugins/full-box-export/captcha.htmlyara2026-10-12 02:04
productpalace.pke547df85…https://productpalace.pk/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:03
narowalgymkhana.com7f91f624…https://narowalgymkhana.com/?cfcw_captcha_page=1yara2026-10-12 02:03
productpalace.pke547df85…https://productpalace.pk/?cfcw_captcha_page=1yara2026-10-12 02:02
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/wp-content/plugins/wp-security-optimizer/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 02:02
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/?cfcw_captcha_page=1#frame=0yara2026-10-12 02:01
fernandeseneri.adv.br950eb8a7…https://fernandeseneri.adv.br/?cfcw_captcha_page=1yara2026-10-12 02:00
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/wp-content/plugins/ads-custom-optimizer/captcha.html#frame=0yara2026-10-12 01:59
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/?cfcw_captcha_page=1#frame=1yara2026-10-12 01:59
wealthywealth.co.za72d06720…https://wealthywealth.co.za/?cfcw_captcha_page=1#frame=0yara2026-10-12 01:59
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/?cfcw_captcha_page=1yara2026-10-12 01:59
www.smartlivingstyle.cat86ebb4b0…https://www.smartlivingstyle.cat/wp-content/plugins/ads-custom-optimizer/captcha.htmlyara2026-10-12 01:59
verifiedbmsells.comc0f7c885…https://verifiedbmsells.com/?cfcw_captcha_page=1#frame=0yara2026-10-12 01:58
wealthywealth.co.za72d06720…https://wealthywealth.co.za/?cfcw_captcha_page=1yara2026-10-12 01:58
verifiedbmsells.comc0f7c885…https://verifiedbmsells.com/?cfcw_captcha_page=1yara2026-10-12 01:57
flutuarweb.com.br802a4f6b…https://flutuarweb.com.br/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:18
safestroutetransport.com74592d28…https://safestroutetransport.com/wp-content/plugins/ckk/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:17
movista.chc50a105a…https://movista.ch/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:16
zamzamksa.comb69287b7…https://zamzamksa.com/wp-content/plugins/visual-images/captcha.html#frame=0yara2026-10-12 00:14
zamzamksa.comb69287b7…https://zamzamksa.com/?cfcw_captcha_page=1#frame=1yara2026-10-12 00:14
zamzamksa.comb69287b7…https://zamzamksa.com/?cfcw_captcha_page=1yara2026-10-12 00:13
zamzamksa.comb69287b7…https://zamzamksa.com/wp-content/plugins/visual-images/captcha.htmlyara2026-10-12 00:13
www.rebatefirm.comc888a7c2…https://www.rebatefirm.com/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:11
www.professorpaulomoraes.com8869afff…https://www.professorpaulomoraes.com/wp-content/plugins/hcaptcha-and/captcha.html#frame=3yara2026-10-12 00:10
www.professorpaulomoraes.com8869afff…https://www.professorpaulomoraes.com/wp-content/plugins/hcaptcha-and/captcha.htmlyara2026-10-12 00:08
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/ckk/assets/js/captcha-loader.js?ver=2.0.0yara2026-10-12 00:08
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/CF/captcha.html#frame=0yara2026-10-12 00:08
scarunites.org68460eeb…https://scarunites.org/wp-content/plugins/CF/captcha.htmlyara2026-10-12 00:07
(inline)de8ef3b1…(inline)yara2026-10-11 23:33
africanyoutharchitects.org#htmlde8ef3b1…https://africanyoutharchitects.org#htmlyara2026-10-11 23:33
christiancordero.mba#htmlfc6aa2c5…https://christiancordero.mba#htmlyara2026-10-11 23:00
(inline)48de73bd…(inline)yara2026-10-11 22:54
adamconsultings.com#html48de73bd…https://adamconsultings.com#htmlyara2026-10-11 22:54
checkmybtrobot.cc0cd70462…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-11 22:43
checkdvvc99.cccf615867…https://checkdvvc99.cc/js/all.min.jsyara2026-10-11 22:21
(inline)46142e9f…(inline)yara2026-10-11 20:49
(inline)95378547…(inline)yara2026-10-11 20:35
secretcrush.fun#html56458b66…https://secretcrush.fun#htmlyara2026-10-11 19:42
(inline)eef6f058…(inline)yara2026-10-11 19:26
(inline)9f9e3366…(inline)yara2026-10-11 18:31
actionawe.org#html6183a4d6…https://actionawe.org#htmlyara2026-10-11 18:28
(inline)f8364136…(inline)yara2026-10-11 18:27
bestsportsgearhub.com#html5b4fd32f…https://bestsportsgearhub.com#htmlyara2026-10-11 18:03
asm-app.com#html7e825756…https://asm-app.com#htmlyara2026-10-11 17:47
(inline)4c4b42f0…(inline)yara2026-10-11 16:01
(inline)e755ed8f…(inline)yara2026-10-11 11:21
checkdvvc99.cc06118274…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 20:36
checkmybtrobot.cc06118274…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 20:36
checkdvvc99.cc88dc2f17…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 17:03
checkmybtrobot.cc88dc2f17…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 17:03
(inline)3620701a…(inline)yara2026-10-09 16:57
(inline)c7ec5fd6…(inline)yara2026-10-09 16:16
blob:https://lesteredesdeprotecao.com.br/ef0b07c1-4a47-49b9-94c2-96c8d68cf10bc7ec5fd6…blob:https://lesteredesdeprotecao.com.br/ef0b07c1-4a47-49b9-94c2-96c8d68cf10byara2026-10-09 16:16
blob:https://lesteredesdeprotecao.com.br/33d11bcf-c74f-4375-9b38-a15beddb955fc7ec5fd6…blob:https://lesteredesdeprotecao.com.br/33d11bcf-c74f-4375-9b38-a15beddb955fyara2026-10-09 16:16
(inline)cab78076…(inline)yara2026-10-09 10:26
nicandle.ch54657bac…https://nicandle.ch/#htmlyara2026-10-09 10:26
(inline)64da7298…(inline)yara2026-10-09 09:54
(inline)89ec894e…(inline)yara2026-10-09 06:01
(inline)08d9f8d1…(inline)yara2026-10-09 04:36
checkmybtrobot.ccda8394f8…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-09 00:35
checkdvvc99.ccda8394f8…https://checkdvvc99.cc/js/all.min.jsyara2026-10-09 00:34
(inline)af088312…(inline)yara2026-10-08 23:48
(inline)7c42474d…(inline)yara2026-10-08 22:33
(inline)97f2a105…(inline)yara2026-10-08 19:49
(inline)fa6671a5…(inline)yara2026-10-08 17:07
(inline)ef711599…(inline)yara2026-10-08 14:22
(inline)817aa57d…(inline)yara2026-10-08 12:22
checkmybtrobot.cc47125f0f…https://checkmybtrobot.cc/js/all.min.jsyara2026-10-08 12:20
checkdvvc99.cc47125f0f…https://checkdvvc99.cc/js/all.min.jsyara2026-10-08 12:20
tranquilacrestomahawk.com#htmlb0910aeb…https://tranquilacrestomahawk.com#htmlyara2026-10-08 12:19
cisco.parivpn.ru92b80206…https://cisco.parivpn.ru/#htmlyara2026-10-04 12:35
mx1.prod.rossko.sud6ff2dea…https://mx1.prod.rossko.su/#htmlyara2026-10-04 12:35
dms.cabinet-ingos.rudaaa841e…https://dms.cabinet-ingos.ru/#htmlyara2026-10-04 12:35
buh.reallstbank.ru21bd62a6…https://buh.reallstbank.ru/#htmlyara2026-10-04 12:35
ai.parivpn.ru66a58636…https://ai.parivpn.ru/#htmlyara2026-10-04 12:35
vpn.reallstbank.ru2a288882…https://vpn.reallstbank.ru/#htmlyara2026-10-04 12:35
alfastrahv.ru9849fa57…https://alfastrahv.ru/#htmlyara2026-10-04 12:35
niluhomeimprovement.comea7ccd42…https://niluhomeimprovement.com/#htmlyara2026-10-04 07:01
(inline)6e24e3ab…(inline)yara2026-10-04 04:29
(inline)d54cfa19…(inline)yara2026-10-04 04:27
(inline)18888b6c…(inline)yara2026-10-04 03:22
datahousemarketing.comafb9f1d1…https://datahousemarketing.com/#htmlyara2026-10-01 19:21
niluhomeimprovement.com539be8c1…https://niluhomeimprovement.com/#htmlyara2026-10-01 19:16
acmaturaky.cz76f6d43b…https://acmaturaky.cz/#htmlyara2026-10-01 19:16
interseq.at44cdc9a4…https://interseq.at/MyTest1109/apiyara2026-09-23 13:21
sportsministry.info#htmla4d1d61d…https://sportsministry.info#htmlyara2026-09-23 02:49
bassprosurvey.storefcbeb0c6…https://bassprosurvey.store/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-23 01:48
checkrobotbb.pw7a4aadbf…https://checkrobotbb.pw/js/all.min.jsyara2026-09-22 12:42
www.hyundaiservisiankara.com#htmlc7fe6f64…https://www.hyundaiservisiankara.com#htmlyara2026-09-22 11:27
inwiththewoods.com#htmlb3c6fbf9…https://inwiththewoods.com#htmlyara2026-09-22 11:26
inwiththewoods.com#html2c5baae6…https://inwiththewoods.com#htmlyara2026-09-22 01:48
mepi.com.sa474be3e3…https://mepi.com.sa/wp-content/litespeed/js/361652a8a3ea8158882d51388f4b8798.js?ver=b8798yara2026-09-21 23:48
www.hyundaiservisiankara.com#html718ef51e…https://www.hyundaiservisiankara.com#htmlyara2026-09-21 01:48
squidscript.com#html42850179…https://squidscript.com#htmlyara2026-09-21 01:48
fundingfactors.com#html2780752e…https://fundingfactors.com#htmlyara2026-09-20 05:48
interseq.at4e36e012…https://interseq.at/potok_1/api?ver=3.2.1yara2026-09-19 15:49
interseq.ata1a1b143…https://interseq.at/lom2/api?ver=1.0.0yara2026-09-19 03:48
agenciadetraduccion.netfa8c25ab…https://agenciadetraduccion.net/wp-content/plugins/safe-rss/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-19 02:48
www.rebatefirm.com8793785d…https://www.rebatefirm.com/wp-content/plugins/neueueu/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-18 22:49
harapouya.ir#html4af84455…https://harapouya.ir#htmlyara2026-09-18 15:48
tedxamsterdamed.nl#html85318545…https://tedxamsterdamed.nl#htmlyara2026-09-18 02:48
oemselect.com#html027d64fa…https://oemselect.com#htmlyara2026-09-17 05:51
(inline)9b635933…(inline)yara2026-09-16 15:54
enerjplus.com#html979e0b11…https://enerjplus.com#htmlyara2026-09-16 08:48
amjadworld.com#htmld4e9d1eb…https://amjadworld.com#htmlyara2026-09-15 02:50
botcheck-cf.top5d371917…https://botcheck-cf.top/js/all.min.jsyara2026-09-14 21:49
garden-sugizo.com#htmla9c903d4…https://garden-sugizo.com#htmlyara2026-09-14 17:48
eesa.surf#html8bbb284c…https://eesa.surf#htmlyara2026-09-14 11:48
checkbot-cf.site2c1a021f…https://checkbot-cf.site/js/all.min.jsyara2026-09-14 04:51
cf-check.site2c1a021f…https://cf-check.site/js/all.min.jsyara2026-09-14 04:51
thamyresheros.com52c96b74…https://thamyresheros.com/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-09-14 02:48
riadlallajihane.com#htmlb2a5e9e8…https://riadlallajihane.com#htmlyara2026-09-13 02:48
hakverdi.net#html18688c23…https://hakverdi.net#htmlyara2026-09-13 01:50
norediam.comca791ac9…https://norediam.com/traffic/apiyara2026-08-26 12:42
norediam.com444ecfbf…https://norediam.com/traffic/apiyara2026-08-26 11:21
norediam.coma7182413…https://norediam.com/traffic/apiyara2026-08-26 07:23
gangesjute.come33f85f1…https://gangesjute.com/wp-content/plugins/one/assets/js/captcha-loader.js?ver=2.0.0yara2026-08-15 03:10
00c29c34fd.nxcli.iof6c071f8…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:47
00c29c34fd.nxcli.io2f465516…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:43
00c29c34fd.nxcli.io52b189eb…https://00c29c34fd.nxcli.io/#htmlyara2026-05-27 10:43