ClickFix Fake-CAPTCHA Incidents Jump 563% as State Actors Adopt Lure
Global – October 12, 2026 -- Incidents involving fake CAPTCHA lures rose 563% in 2025, according to the CrowdStrike 2026 Global Threat Report, as adversaries including STARDUST CHOLLIMA and VOODOO BEAR adopted the social engineering technique known as ClickFix.
ClickFix turns the victim into the execution mechanism
The attack shows a fake error, CAPTCHA or system message and tells the user to copy a command into the Windows Run dialog, PowerShell or Terminal. In some variants, malicious JavaScript places the command on the clipboard directly.
The pasted command can launch PowerShell, VBScript or another legitimate interpreter to fetch further payloads. CrowdStrike observations show follow-on activity including malware deployment, credential theft, persistence, command and control, and data theft.