Microsoft Flags New ClickFix Scheme Using Bogus CAPTCHAs to Deploy Malware

Microsoft Threat Intelligence has warned about a new campaign dubbed ClickFix that leverages fake CAPTCHA prompts on compromised sites to coax Windows users into running malicious commands. The technique relies on users believing they must solve a verification puzzle before accessing content, but the prompt actually triggers code execution.

In the observed attacks, the malicious actors first inject a script into vulnerable webpages. When a visitor loads the page, the script presents a CAPTCHA‑style dialog that mimics legitimate security checks. The dialog asks the user to type characters or click a checkbox, and the underlying code uses that interaction to write a payload into the browser’s cache.

Once the payload resides in the cache, a subsequent action—often a seemingly innocuous navigation or page refresh—causes the cached code to be executed. The executed commands can download additional malware, establish persistence, or harvest credentials from the compromised Windows machine. Because the execution happens within the browser context, traditional antivirus alerts may be bypassed.

The campaign is notable for its use of the browser cache as a staging area, a tactic that complicates detection. Security researchers have seen the payloads target common Windows utilities such as PowerShell and Windows Management Instrumentation, allowing the attackers to run a wide range of malicious instructions with elevated privileges.

Microsoft’s advisory urges users to keep browsers and operating systems up to date, to disable automatic execution of scripts where possible, and to be skeptical of unexpected verification prompts, especially on sites that do not normally require CAPTCHAs. Organizations are also advised to monitor network traffic for unusual cache‑related activity and to employ web‑gateway filters that can block malicious scripts before they reach end‑users.

The emergence of ClickFix follows a broader trend of attackers exploiting trust in familiar web elements to bypass security controls. By disguising malware delivery as a routine user interaction, the threat actors increase the likelihood of successful infection. Continued vigilance and layered defenses remain essential as adversaries refine such social‑engineering tactics.