Plan
active
TerminalFix ClickFix Variant Uses Fake CAPTCHAs to Run PowerShell Backdoor
- Engineer — Learn: Novel ClickFix variant redirecting victims to Windows Terminal/PowerShell rather than the Run dialog increases execution success for complex payloads; no patch applies, but this is a good prompt to verify PowerShell Script Block Logging and AMSI are enabled and that AppLocker/WDAC policies restrict terminal abuse.
- SOC/IR — Plan: Build or tune detections for browser or web-content processes spawning Windows Terminal/PowerShell children that then launch reverse-tunnel tooling; also baseline and alert on known tunnel binaries (ngrok, frp, chisel) appearing post-user-session, since no IOCs are published yet to support an immediate hunt.
- Leader — Learn: Awareness of this technique evolution is useful background for refreshing phishing/social-engineering guidance in security awareness programs, but it does not require a leadership statement or risk-register update at this time.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.