Fake CAPTCHA Prompt Hijacks Windows Run to Deploy Malware via Browser Cache

A newly identified cyber‑campaign dubbed ClickFix is converting ordinary web safety checks into a conduit for malicious software. Security analysts say the scheme tricks visitors of compromised sites into executing hidden code by presenting a counterfeit CAPTCHA or system‑repair message.

The deceptive prompt instructs users to open the Windows Run dialog, paste a short string of text that the page has copied to the clipboard, and press Enter. While the steps appear innocuous, the pasted command points to an executable file silently stored in the browser's cache, causing Windows to launch the payload without any further user interaction.

Technical examinations reveal that the cached file is typically a Windows executable disguised as a harmless resource, such as an image or JavaScript library. By leveraging the Run dialog—a trusted system utility—the attack bypasses common browser warnings and antivirus prompts, allowing the malware to gain a foothold with minimal friction.

ClickFix follows a familiar pattern of social‑engineering attacks that exploit users' expectations of security features. CAPTCHAs are widely trusted as barriers against bots, and fake repair alerts tap into the instinct to follow straightforward instructions to fix perceived problems. This familiarity makes the lure particularly effective, especially for less‑tech‑savvy individuals.

Early observations indicate that the delivered malware exhibits typical trojan behavior, ranging from credential harvesting to the deployment of ransomware or cryptomining modules. Researchers suspect the malicious script is injected into otherwise legitimate websites, possibly through compromised advertising networks or vulnerable content‑management systems.

Security firms are currently dissecting the campaign, and Microsoft has been alerted to the misuse of the Run command. Experts advise users to resist copying and executing unknown commands, to keep operating systems and browsers up to date, and to employ reputable security software that can detect anomalous file activity in the cache directory.

The ClickFix episode underscores the evolving tactics of threat actors who weaponize everyday user interfaces. Vigilance and a healthy skepticism toward unsolicited system instructions remain essential defenses against such covert infection vectors.