Global – October 12, 2026 -- Incidents involving fake CAPTCHA lures rose 563% in 2025, according to the CrowdStrike 2026 Global Threat Report, as adversaries including STARDUST CHOLLIMA and VOODOO BEAR adopted the social engineering technique known as ClickFix.
ClickFix turns the victim into the execution mechanism
The attack shows a fake error, CAPTCHA or system message and tells the user to copy a command into the Windows Run dialog, PowerShell or Terminal. In some variants, malicious JavaScript places the command on the clipboard directly.
The pasted command can launch PowerShell, VBScript or another legitimate interpreter to fetch further payloads. CrowdStrike observations show follow-on activity including malware deployment, credential theft, persistence, command and control, and data theft.
Because the user initiates execution, the technique evades security tools built solely to stop malicious files. Adversaries can also rotate domains, compromise legitimate websites, change impersonated brands, or swap a fake meeting error for a fake CAPTCHA without changing the underlying method.
STARDUST CHOLLIMA deployed two new malware families through a fake meeting page
In July 2026, STARDUST CHOLLIMA very likely targeted an employee at a financial services entity using infrastructure masquerading as a video conferencing site. The employee almost certainly saw a fake technical issue with a command presented as the fix.
Running it triggered a PowerShell- and VBScript-based infection chain that deployed two previously unknown malware families, GeniexLoader and GeniexRAT.
VOODOO BEAR hit organizations in three countries with fake CAPTCHAs
In May and June 2026, CrowdStrike Falcon Complete managed detection and response (MDR) detected likely VOODOO BEAR intrusions affecting employees believed to be Ukrainian at organizations in France, the United States and Canada. CrowdStrike Intelligence assesses the group almost certainly used ClickFix to get users to run PowerShell commands that downloaded a VBScript payload.
The group likely compromised websites of Ukrainian local government, energy, agriculture and logistics entities to serve the fake CAPTCHAs to Ukrainian visitors.
CrowdStrike maps controls to each stage of the chain
CrowdStrike argues that ClickFix spans phishing, browser activity, endpoint execution and identity compromise, so it cannot be handled as a single-point problem. Stolen credentials or tokens can extend an intrusion into SaaS applications, cloud environments and additional systems.
The vendor outlines a layered response:
- Before execution: Falcon Seraphic Enterprise Browser provides in-browser visibility and enforcement and is designed to disrupt the copy-and-paste mechanism.
- At execution: Falcon Prevent and Falcon Insight XDR identify and prevent suspicious PowerShell, VBScript, process and command-line behavior.
- After initial access: Falcon Identity Threat Protection targets credential abuse and lateral movement, while Falcon Next-Gen SIEM correlates endpoint, identity, browser and cloud telemetry.
- Across the environment: Falcon Adversary OverWatch and Falcon Complete add threat hunting, investigation, containment and remediation.
CrowdStrike says defenders need controls that disrupt the lure, stop execution, detect credential abuse and respond before initial access becomes a wider compromise, rather than relying on URL blocking or user warnings about pasting commands.