Executive Summary

ClickFix — the fake-CAPTCHA and fake-error family that convinces a user to paste and run a command themselves — has been treated as a social-engineering trick with a stable payload. Research presented by Bert-Jan Pals at OrangeCon in early June 2026, and published in detail on June 30, revises that picture. Pals took apart several ClickFix platforms and analyzed roughly 3,000 payloads pulled from live campaigns. The finding that matters for defenders is architectural: the malicious command is no longer baked into the lure page. It is fetched from a backend that behaves like an on-demand service — it takes a request, checks an access token, logs the caller, and returns a freshly scrambled command every time.

That changes the economics of indicator sharing. A payload captured from one victim is a sample of one request, not a signature. The next visitor to the same page receives the same malware wrapped differently. Two other shifts compound the problem: a newer staging method that copies a short orchestrator command instead of the payload itself, designed to slip past clipboard and in-memory inspection, and a move in the lure instructions from the Win+R Run dialog to Win+X and Windows Terminal, which erases the registry artifact many detections rely on. The durable defender signal is the execution shape the technique produces, not the text it asks the user to paste.

AttackAttack Overview

The front end is unchanged in spirit. A booby-trapped page presents a "verify you are human" CAPTCHA or a browser-error interstitial and instructs the user to open a shell prompt, paste a command, and press Enter. The user supplies the execution that no exploit provided.

The back end is what evolved. Rather than embedding a static one-liner in the page's JavaScript, current platforms call a payload server at click time. Pals documented backend servers acting as a payload-as-a-service tier: each request is authenticated against a token, logged, and answered with a command wrapped in a rotating combination of Base64, AES, TripleDES, Rijndael, and Deflate. The obfuscation layer is selected per response, so the byte pattern a defender extracts from one interaction is unlikely to recur. Three payload servers named in the research — `comicstar[.]lat`, `babybon[.]cfd`, and `merkantalolol[.]asia` — illustrate the throwaway, rotating nature of the delivery infrastructure.

A second-generation execution method raises the evasion further. Instead of copying the full payload to the clipboard, the newer "Downloads-folder" variant copies a short orchestrator command. The command moves a file already sitting in the user's Downloads directory and stages execution from there, keeping the payload out of the clipboard and reducing what Windows Antimalware Scan Interface sees at paste time. Pals recorded an orchestrator of the shape `powershell -C "$t=$env:TMP; Move-Item "$HOME\Downloads\tmp.zip" ...`, where the visible instruction looks innocuous and the consequential behavior happens after the move.

AttackInfrastructure & Tradecraft

The design goal across these changes is to make the delivered artifact ephemeral and the delivery infrastructure disposable. Per-request scrambling means the payload has no stable hash. Token-gated backends mean a researcher who lacks a valid caller token gets nothing useful, which frustrates automated scraping and sandbox retrieval — the same server-side gating logic that kits like PoisonSeed used to validate victim email before rendering a login form, now applied to payload delivery.

It is worth being precise about what "scrambled" means here, because the command still has to run in the shell the user pastes it into. The obfuscation is not aimed at the interpreter or the human — it cannot be, since the shell must execute the command and the user has been told to trust it. What the backend returns is a self-decoding loader: a short, readable stub plus an encoded blob, where the stub carries the routine to decode the blob at runtime — a Base64 decode, an AES or TripleDES key, a Deflate decompression — and then hands the reconstructed result to Invoke-Expression. The interpreter rebuilds and runs the payload; a defender's blocklist sees a byte pattern that will not recur, because the backend re-wraps the same inner payload with a different cipher and key on the next request. The scrambling targets automated retrieval and indicator sharing. The human is handled separately, by social engineering: a "verification code" framing, a hidden-window flag, and whitespace padding that pushes the consequential part of the command out of view in the paste box. The Downloads-folder method goes further and keeps the heavy blob off the clipboard entirely, so what little AMSI inspects at paste time is only the innocuous-looking stub.

The Win+X pivot is a quieter but important piece of tradecraft. The long-standing ClickFix instruction told users to press Win+R, which populates the RunMRU key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` — a durable forensic breadcrumb and a common detection anchor. Directing users to Win+X and Windows Terminal accomplishes the same execution with no RunMRU entry, and it launches the shell as a child of a different parent process. Detections written narrowly around the Run dialog silently stop firing.

None of this makes the follow-on payload more capable. Public reporting continues to associate ClickFix chains with commodity loaders and stealers whose behavior is operator-dependent and unstable across campaigns. The lesson is that the delivery and staging layer, not the final payload, is where operators are investing, and it is where static indicators degrade fastest.

DetectionDetection Opportunities

The detection that survives per-request polymorphism keys on process ancestry and immediate side effects rather than command content. A user-facing shell host — historically `explorer.exe`, now also `WindowsTerminal.exe` — spawning `powershell.exe`, `cmd.exe`, or `msiexec.exe`, followed within seconds by network egress or a write-and-execute out of the Downloads or TEMP directories, is the shape the technique cannot avoid. It has to run something, from a context the user controls, and it has to reach out or stage locally.

The most important update for existing ClickFix detections is to add `WindowsTerminal.exe` as an initiating parent alongside `explorer.exe`. A rule that matches only the Run dialog will miss the Win+X path entirely. Pair the process-ancestry match with a short-window correlation to network connections or to file activity under `Downloads`, and the fidelity holds even when the pasted string is unrecognizable.

// Execution-shape hunt for API-served ClickFix, resilient to per-request
// payload scrambling and the Win+X / Windows Terminal pivot. Match a
// user-facing shell host spawning a script/installer host; the command
// string is intentionally NOT the anchor because it is polymorphic.
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe", "OpenConsole.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "msiexec.exe", "wscript.exe")
| where ProcessCommandLine has_any ("Downloads", "$env:TMP", "Move-Item", "Invoke-", "http")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
          FileName, ProcessCommandLine

ValidationValidation Workflow

Confirm the detection against both execution paths before trusting it. In an isolated test host, reproduce the benign mechanics of each variant with a harmless command — the classic Win+R path and the Win+X / Windows Terminal path — and verify the rule fires on both. A rule validated only against the Run dialog is a rule validated against yesterday's tradecraft.

Then exercise the polymorphism assumption directly. Take two distinct obfuscation wrappings of the same benign action and confirm that the detection fires on execution shape without depending on the command text. If the rule only matches when a specific string is present, it will not survive contact with a per-request backend. Finally, verify your telemetry actually records the Downloads-to-execution sequence: generate a file in `Downloads`, move and stage from it, and confirm the file and process events can be joined on a common timeline. Authorized test tenants and lab endpoints only — this validation is about proving detections, not distributing a working chain.

GapsEvasion & Gaps

The server-side model is explicitly built to defeat sample-based defense. Indicator feeds that circulate a payload hash or a pasted-command string age out within a campaign cycle, sometimes within a single request. Token gating denies the artifact to anyone the operator has not authorized, which limits both crowd-sourced sample collection and automated sandbox retrieval. The AMSI-conscious Downloads-folder method reduces what script-content inspection observes at the moment of paste.

The gap that remains open for defenders is behavioral, and operators have not closed it because they cannot. The technique requires a human-driven shell host to execute attacker-chosen code and then either reach the network or stage from disk. That sequence is observable regardless of how the string is wrapped or which shortcut key launched the shell. The risk on the defender side is stale detection logic: rules anchored to the Run dialog, to a specific parent process, or to a known command pattern will report clean while the technique runs through the paths they do not cover.

Defensive Recommendations

Update ClickFix detections to treat the pasted string as untrusted and unstable. Anchor on the parent-child process relationship and the immediate follow-on behavior, and add `WindowsTerminal.exe` and `OpenConsole.exe` to the set of user-facing initiating processes you consider suspicious when they spawn a script or installer host. Correlate with network egress and with write-then-execute activity under `Downloads` and `TEMP` to raise fidelity.

Reduce the attack surface where the environment allows it. Constrained Language Mode and PowerShell logging (script block and module logging) preserve evidence even when AMSI is sidestepped at paste time. Application control that governs which processes may launch from user-writable directories blunts the Downloads-staging method. And targeted user education still measurably helps against this specific pattern: teach people that no legitimate CAPTCHA, browser update, or IT process ever asks them to open a terminal and paste a command. Generic anti-phishing training does not transfer to this case; the paste-and-run instruction, named plainly, is what sticks.