You definitely don't want to CopyPaste this: FakeCaptcha ecosystem

You definitely don't want to CopyPaste this: FakeCaptcha ecosystem

Speakers: Dmitrij Lenz, Security Researcher, Google; Roberto Dasilva, Security Researcher, Google

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=fMF2cwDc0uM

Overview

In a compelling presentation at Virus Bulletin, Google security researchers Roberto Dasilva and Dmitrij Lenz unveiled the intricate and rapidly evolving ecosystem behind ClickFix, a malicious technique widely known as FakeCaptcha. This talk delves into a sophisticated threat observed from 2023 to the present, which exploits user trust and common web interactions to trick victims into executing arbitrary malicious commands. Dasilva, with a decade of experience spanning Android development, malware analysis, and incident response, joined Lenz, whose primary focus at Google's Threat Intelligence Group is financially motivated threats, to illuminate the mechanics, evolution, and pervasive impact of ClickFix.

The core of ClickFix lies in its deceptive simplicity: users are lured to compromised websites where they encounter a fake CAPTCHA verification. Instead of traditional image selection or text entry, they are instructed to open their terminal and paste a seemingly innocuous command. This command, however, is a malicious script designed to download and execute subsequent stages of an attack. The researchers highlighted that this technique poses a significant and growing risk, not only to individual users but also to organizations of all sizes, serving as an initial entry point for a wide array of serious incidents, from ransomware to state-sponsored compromises.

The presentation meticulously tracks the evolution of ClickFix kits, from rudimentary JavaScript blobs to highly dynamic and resilient architectures, detailing how threat actors continuously adapt their methods to evade detection and enhance operational effectiveness. By dissecting the technical underpinnings, examining underground market offerings, and even analyzing the repurposing of crime kits by advanced persistent threat (APT) groups, Dasilva and Lenz provided a comprehensive overview of a challenge that blue teams find increasingly difficult to identify and defend against.

Background

▶ Watch: Defining ClickFix and its attack chain (1:20)

The genesis of the ClickFix problem stems from a confluence of user behavior and technical vulnerabilities. In today's digital landscape, CAPTCHAs are ubiquitous, a common gatekeeper against automated bots. Users, accustomed to these verification steps, often approach them with a sense of routine and a desire for quick resolution, leading to a critical lack of scrutiny. Threat actors capitalize on this ingrained behavior, presenting a fake CAPTCHA that deviates subtly but dangerously from the norm. Instead of an interactive puzzle, the user is presented with instructions to open their terminal or command prompt and paste a command. This interaction preys on the average user's unfamiliarity with command-line interfaces and the potential ramifications of executing arbitrary scripts.

The attack chain is deceptively simple and highly effective:

1. The Lure: A user navigates to a compromised or malicious website. These sites often appear legitimate, having been injected with ClickFix JavaScript.
2. The Pop-up: A message appears, typically claiming the user needs to verify they are not a robot by solving a CAPTCHA.
3. The Trick: Rather than asking for clicks on images or text input, the fake CAPTCHA instructs the user to open their terminal (e.g., by pressing Windows + R and typing cmd or powershell) and paste a command that is already copied to their clipboard. This command is presented as a benign verification step.
4. The Execution: The pasted command is, in fact, a malicious script. This script then downloads and executes the next stage of the attack, which could be an info-stealer, a loader for other malware, or a backdoor.

Several factors contribute to ClickFix's success:

• User Trust and Haste: Users inherently trust the CAPTCHA process and are often in a rush to complete it, reducing their vigilance.
• Console Unfamiliarity: Most users are not proficient with the command line and do not scrutinize the commands they are told to paste, especially if they appear long or complex.
• Adaptability: ClickFix kits are easy for threat actors to update and adapt, allowing rapid changes in themes, lures, and malicious components.
• Evasion Capabilities: The technique often evades basic security measures. A significant portion of the malicious execution occurs in memory, leaving minimal forensic evidence for detection and analysis.

The scale of this operation is vast. The researchers identified approximately 30 distinct criminal groups and APTs consistently employing ClickFix. Since early 2024, over three million landing pages featuring injected ClickFix JavaScript have been collected, primarily from compromised legitimate websites. This widespread deployment has led to nearly 350 direct incidents addressed by Google, underscoring the technique's efficacy and the significant risk it poses to both individuals and organizations.

Key Findings

▶ Watch: AN 5142's advanced Azer hiding technique (8:20)

The research revealed a remarkable evolution in the architecture and sophistication of ClickFix kits, alongside insights into the threat actors leveraging them.

Initially, ClickFix kits were simple JavaScript blobs, with a single click event listener function responsible for all operations, from copying the malicious command to displaying messages. Over time, these kits matured, adopting more granular architectures that align with better software engineering practices. Functions began to follow single responsibility principles, making them more robust and harder to fully dismantle. A significant development was the introduction of a verification ID, a string followed by a number appended to the malicious command. While seemingly minor, this addition created new detection artifacts, including random number generators and string concatenating functions, which security researchers can leverage.

A critical detection point identified is the clipboard copy data function. Regardless of the kit's complexity, it must use one of two methods to copy the malicious command to the clipboard: the legacy execCommand('copy') or the modern Clipboard API with clipboard.write() call. These two avenues represent a fundamental choke point for detection and intervention. Furthermore, threat actors have begun adopting the jQuery library to enhance their kits, adding dynamism and enabling more centralized control.

While ClickFix's success is evident, not all threat actors fully trusted it from the outset. ANK 5904, a primary distributor of Dancerop (also known as Raspberry Robin), adopted ClickFix early (October 2024, likely a typo in transcript, usually 2023 or earlier given the context of "early adopter"), but initially complemented it with drive-by download techniques as a backup. Similarly, an unattributed ClickFix kit used a fake CAPTCHA narrative without any clipboard interaction, instead keeping the user waiting until a redirect dropped a malicious archive. However, these combined approaches have become exceptions rather than the norm, with threat actors increasingly relying solely on the ClickFix mechanism.

A particularly notable group is ANK 5142, recognized as an early adopter of the Azer-hiding technique. Azer-hiding involves concealing parts of the redirection chain, such as scripts or parameters, within crypto transaction fields. This technique makes campaign disruption exceedingly difficult, offers real-time control over thousands or millions of deployments, and complicates infection chain detection. ANK 5142, after initially applying Azer-hiding to fake update campaigns, quickly adapted it for ClickFix narratives. This group has emerged as a dominant player, combining website hijacking with Azer-hiding, and is known for distinctive templates like MS Defender alerts or connection verification requests. Their operations are also multi-platform, including dedicated templates for the MacOS ecosystem.

Monitoring the effectiveness of their campaigns is crucial for threat actors, leading to the evolution of reporting channels. Early ClickFix versions lacked built-in reporting. Over time, unstructured calls to Command and Control (C2) infrastructure were integrated. As defensive responses matured, so did these reporting channels, becoming more integrated into the kit's architecture and often combined with C2 checks, where the kit's behavior depends on C2 responses. To enhance resilience against service takedowns, threat actors transitioned from dedicated infrastructure to more legitimate services. Concurrently, telemetry collection significantly increased, evolving from simple pings to full-fledged in-browser user fingerprinting, often utilizing Telegram bots as efficient collection mechanisms.

Analyzing the commands victims face, excluding the high-volume ANK 5142 and 5904, PowerShell remains the dominant ClickFix command. Interestingly, most PowerShell commands are in clear text, relying on their sheer length to hide the malicious portion from the victim's view within a typical command window. A prevalent tactic is adding an I'm not a robot string comment, followed by a verification ID, effectively extending the string and pushing the malicious payload to the beginning, out of immediate sight. These PowerShell commands are typically one-liners designed to download and execute subsequent stages, using methods like Invoke-WebRequest, Invoke-Expression, bitsadmin, certutil, and msiexec.

For ANK 5904, the approach differs: they predominantly use MSHTA to execute externally hosted scripts. This tactic is further complemented by embedding HTA scripts within common media files (e.g., JPEG, AV, MP3), exploiting MSHTA's disregard for any content outside of HTA script tags. This method effectively circumvents conventional PowerShell-centric security mechanisms such as PowerShell logging and Antimalware Scan Interface (AMSI).

Beyond internally developed kits, the success of ClickFix has spurred an underground market for builders. Two prominent services are Traffic Shark Light by the actor LDR and Lucy service. LDR's kit is notable for generating deployments that combine landing pages with an admin panel on the same domain, offering customization options. Crucially, it employs in-memory loading, pulling obfuscated HTML containing the CAPTCHA via Ajax, then de-obfuscating and displaying it on the fly. This technique allows the kit to bypass security solutions that rely on matching signatures against network traffic. The Lucy service stands out for its author's creativity, consistently introducing unique templates and features, such as a compelling Windows Update narrative with additional deceptive features.

Finally, the research highlighted that ClickFix is not exclusive to criminal groups; many state-sponsored APT groups globally also leverage it. These APTs often repurpose existing crime kits but introduce subtle modifications. These modifications serve several purposes: differentiating their operations from commodity crime to evade prevalent detections, minimizing external dependencies by embedding entire libraries and images as inline Base64 blobs within the HTML, and achieving more precise visibility into the infection chain through multiple feedback pings. While the overall architecture and function names often remain similar, APT 42, for instance, changes function names while keeping the code identical, whereas ANK 4057 (also known as Callisto or Coldriver) renames strings. These consistent deviations are highly beneficial for security researchers, enabling them to distinguish between state-sponsored and criminal versions and tailor detection strategies accordingly.

Technical Deep Dive

▶ Watch: Underground markets offering ClickFix builder services (14:20)

The technical evolution of ClickFix kits underscores a continuous arms race between threat actors and defenders. Early kits were rudimentary, often a single, monolithic JavaScript block. The click event listener was the central trigger, handling all actions such as copying the command to the clipboard and displaying user messages. This simplicity made them easier to detect through signature-based methods targeting specific strings or function calls.

Modern kits, however, reflect an increasing adoption of more sophisticated software engineering principles. Functions are granular, adhering to the single responsibility principle. This modularity makes the kits more resilient to analysis and allows for easier updates. A key innovation is the verification ID, typically a string like I'm not a robot followed by a number. This ID is appended to the malicious command. Its implementation requires artifacts like random number generators and string concatenation functions, which, while seemingly benign, provide unique signatures for detection.

The mechanism for copying the malicious command to the user's clipboard is a critical technical choke point. Threat actors must employ one of two methods: the older, legacy execCommand('copy') API or the more modern Clipboard API with clipboard.write(). Monitoring calls to these specific browser APIs, particularly when triggered from suspicious contexts or originating from newly injected JavaScript, offers a robust detection opportunity. The adoption of jQuery by some kits further indicates a move towards more dynamic and centrally controlled operations, potentially leveraging jQuery's DOM manipulation and AJAX capabilities to make the kits more interactive and resilient.

Reporting channels have also undergone significant technical maturation. Initially, these were simple, unstructured HTTP requests to C2 infrastructure, often just a "fire and forget" ping. As defenses evolved, reporting became more integrated, with kit behavior often dependent on responses from C2 requests. To enhance resilience, threat actors shifted from dedicated C2 servers to legitimate services like Telegram bots for data exfiltration and command receipt. Furthermore, telemetry collection escalated from basic pings to sophisticated in-browser user fingerprinting, gathering extensive information about the victim's environment, which is then exfiltrated via these resilient channels.

The malicious commands themselves demonstrate clever obfuscation. While PowerShell is the dominant language, many commands are transmitted in clear text. Their obfuscation relies on sheer length: the malicious payload is placed at the beginning, followed by a lengthy, benign-looking string (often including the I'm not a robot comment and verification ID), ensuring that only the innocuous tail is visible in a standard terminal window. Common download methods for the next stage include Invoke-WebRequest, Invoke-Expression for direct execution, bitsadmin for background transfers, certutil for downloading files, and msiexec for executing MSI packages, all of which can be monitored by endpoint detection systems.

ANK 5904 (Dancerop/Raspberry Robin) employs a distinct technique: leveraging MSHTA (Microsoft HTML Application host). Instead of PowerShell, they use mshta.exe to execute externally hosted HTML Application (HTA) scripts. A particularly insidious variant embeds these HTA scripts within seemingly harmless media files (JPEG, AV, MP3). This exploits mshta.exe's behavior of parsing and executing only the HTA script tags within a file, ignoring other content. This method is highly effective at bypassing PowerShell-centric security mechanisms such as PowerShell logging and AMSI, as the execution chain avoids PowerShell entirely.

The underground market for ClickFix builders introduces further technical challenges. Traffic Shark Light by LDR uses in-memory loading. The landing page contains minimal malicious code. Instead, it uses an AJAX library to pull an obfuscated HTML block containing the actual CAPTCHA or ClickFix logic from the server. This obfuscated block is then de-obfuscated and rendered client-side on the fly. This technique makes network-level signature detection difficult, as the malicious HTML content is not directly present in the initial page load or easily discernible in raw network traffic without deep inspection.

Finally, the repurposing of crime kits by APTs reveals specific technical modifications. APTs prioritize minimizing external dependencies, often embedding entire external libraries, images, and other resources as inline Base64 blobs directly into the HTML. This makes the kit self-contained and reduces network indicators. While the core architecture may remain similar to crime kits, APTs introduce subtle changes. For example, APT 42 might change function names (e.g., copyMaliciousCommand() to performVerification()) while leaving the underlying JavaScript code identical, even retaining commented-out lines. In contrast, ANK 4057 (Callisto/Coldriver) might rename specific strings within the code while preserving function names and logic. These consistent, albeit minor, technical deviations serve as valuable indicators for distinguishing state-sponsored operations from commodity malware, enabling more precise attribution and defensive strategies.

Demo / Proof of Concept

▶ Watch: State-sponsored groups repurposing and modifying ClickFix kits (20:00)

While the talk didn't feature a live, interactive demonstration in the traditional sense, the speakers provided numerous visual examples and code snippets from actual ClickFix campaigns, effectively serving as a proof of concept for the techniques discussed. These visual aids illustrated the evolution and sophistication of the lures and underlying code.

The presentation began by showcasing one of the earliest ClickFix versions, presenting a simple, static HTML lure. This example clearly displayed the characteristic copy-paste instructions, often referencing the Windows R key combination to open the run dialog. The corresponding HTML code snippet was shown, highlighting the basic structure and the JavaScript functions that would trigger after a user clicked a "verify" button, copying the malicious PowerShell command to the clipboard.

Moving to more complex examples, the speakers presented a dynamic kit observed around October 2024. This demonstrated a significantly more sophisticated and visually appealing lure. Code snippets revealed newly introduced components like addCaptureListener and showVerifyWindow, emphasizing their role in constructing the malicious command and initiating the kit's full functionality. These elements were highlighted as key identifiers for future versions.

A particularly insidious example involved the use of media components to enhance the deception. The speakers played an audio snippet of a Windows Defender sound alert, which was integrated into a lure. This tactic aimed to trick users into believing there was a connectivity or protection service issue, prompting them to follow on-screen instructions to "fix" it by pasting the malicious command.

The most recent and alarming example presented was a screen takeover scenario. Users were served a fake Windows Update screen that displayed in full-screen mode. Crucially, escape keys were disabled, mimicking a genuine system update and creating a sense of inevitability, giving the user the impression that the process could not be bypassed. The presentation included screenshots of both the full-screen user interface and the background code demonstrating how this effect was achieved. These visual proofs effectively conveyed the increasing realism and coercive nature of modern ClickFix campaigns.

Defensive Implications

▶ Watch: Key takeaways and the persistent, evolving threat of ClickFix (24:20)

Defending against ClickFix requires a multi-layered, proactive, and continuously evolving strategy, given its persistent nature, rapid adaptation, and sophisticated evasion techniques. Blue teams face significant challenges in identifying these threats due to their in-memory execution, obfuscation, and constant emergence of new variants.

1. Endpoint Detection and Response (EDR) & Behavioral Monitoring:

• Clipboard API Monitoring: EDR solutions should monitor for suspicious calls to browser APIs like execCommand('copy') or clipboard.write(), especially when originating from web content or unexpected JavaScript contexts.
• Command Line Activity: Closely scrutinize terminal commands. Look for long, obfuscated PowerShell one-liners, mshta.exe spawning from browser processes or unexpected locations, or other unusual command executions (bitsadmin, certutil, msiexec) that originate from user interaction with web browsers.
• Process Monitoring: Detect powershell.exe or mshta.exe being invoked with unusual arguments or from unexpected parent processes (e.g., a browser).
• Memory Forensics: Due to in-memory execution, robust memory analysis capabilities are crucial for identifying payloads that leave little disk-based evidence.
• Screen Takeover Detection: Implement behavioral detections for full-screen browser activity that disables user input (like escape keys), especially when combined with fake system alerts.

1. Network Security:

• Web Proxy/Gateway Inspection: While in-memory loading (e.g., Traffic Shark Light) can evade some network signatures, inspect AJAX requests for large, obfuscated HTML blocks or JavaScript fetched from suspicious domains.
• C2 Traffic Analysis: Monitor for connections to known C2 infrastructure or unusual communications with legitimate services (like Telegram APIs) from within the network, particularly from user workstations.
• DNS Monitoring: Identify and block connections to newly registered domains or domains with suspicious characteristics often used in ClickFix campaigns.

1. User Education and Awareness:

• Critical Thinking for CAPTCHAs: Educate users to be highly suspicious of any CAPTCHA prompt that deviates from standard image selection or text entry, particularly those instructing them to open a terminal or paste commands.
• Command Line Caution: Emphasize that pasting arbitrary commands into a terminal is a high-risk action. Users should never do this unless they fully understand the command's function and its source.
• Browser Security: Encourage the use of up-to-date browsers and security extensions that can help block malicious scripts and pop-ups.

1. Threat Intelligence Integration:

• Advanced Intelligence Feeds: Leverage up-to-date threat intelligence on ClickFix campaigns, including new lures, templates, C2 indicators, and specific JavaScript artifacts (like verification IDs or unique function names).
• YARA Rules/Signatures: Develop and deploy YARA rules or other signatures based on the identified artifacts, such as specific JavaScript function names (addCaptureListener, showVerifyWindow), clipboard API calls, or unique strings used in the commands.
• Distinguish APT vs. Crime: Use the identified modifications (e.g., APT 42 changing function names, ANK 4057 renaming strings, inline Base64 blobs) to distinguish between commodity crime and state-sponsored attacks, allowing for tailored response strategies.

1. Proactive Security Posture:

• Patch Management: Ensure all systems, browsers, and security software are fully patched to mitigate vulnerabilities that threat actors might exploit to compromise websites or deliver ClickFix.
• Application Whitelisting: Implement application whitelisting to restrict the execution of unauthorized executables, especially for command-line tools like PowerShell and MSHTA.
• PowerShell Logging and AMSI: Enable comprehensive PowerShell logging and integrate AMSI where possible, although awareness of MSHTA bypasses is critical.
• Multi-Platform Defense: Recognize that ClickFix targets multiple operating systems (e.g., MacOS) and ensure defensive strategies cover all relevant platforms.

By combining robust technical controls with continuous threat intelligence and comprehensive user education, organizations can significantly enhance their resilience against the evolving threat of ClickFix.

Key Takeaways

• ClickFix is a Persistent and Evolving Threat: Far from a simple trick, ClickFix has matured into a sophisticated, adaptable, and resilient attack vector that continues to evolve with new variants and techniques, moving beyond basic malware delivery.
• Gateway to Serious Incidents: This technique is a confirmed initial entry point for a wide range of severe security incidents, from commodity ransomware and info-stealers to highly targeted state-sponsored compromises, posing significant risk to both individuals and organizations.
• Challenges for Blue Teams: Due to constant evolution, in-memory execution, clever obfuscation, and the use of legitimate services, ClickFix campaigns are incredibly difficult for blue teams to identify and defend against using traditional methods.
• Proactive and Adaptive Defense is Crucial: Effective defense requires highly proactive and continuously evolving strategies, leveraging advanced threat intelligence to keep pace with new lures, templates, C2 infrastructure, and technical bypasses.
• Key Detection Points Exist: Despite its sophistication, critical detection opportunities lie in monitoring specific browser API calls (e.g., execCommand('copy'), clipboard.write()), unique JavaScript function names, verification IDs, and unusual command-line activity (PowerShell, MSHTA) originating from web contexts.
• Multi-Platform and Advanced Techniques: The threat is expanding to other operating systems (e.g., MacOS) and incorporating advanced techniques like Azer-hiding and in-memory loading, demanding broader defensive coverage and deeper technical understanding.

About the Speaker(s)

Roberto Dasilva is a Security Researcher at Google's Threat Intelligence Group. He brings over 10 years of diverse experience in the industry, having performed various roles including Android developer, SK analyst, malware analyst, and incident responder.

Dmitrij Lenz is also a Security Researcher at Google's Threat Intelligence Group. His current work primarily focuses on financially motivated threats, with ClickFix being one of the key areas of his research.