Why This Matters Now
Fake-CAPTCHA paste-and-run, commonly shorthanded as ClickFix or ClearFake depending on the variant, started as a niche social-engineering trick in early 2024 and became one of the most common stage-one execution paths reported across Microsoft, Proofpoint, ReliaQuest, and Sekoia by 2025 and into 2026. The reason it scaled is structural rather than novel: the technique sidesteps email-attachment defenses by moving the malicious code out of the email entirely and into the user's clipboard, where the user themselves becomes the execution vector.
For defenders, the consequence is that the high-fidelity signal moved. The email gateway sees a benign link, or sometimes nothing at all. The browser sees a webpage that legitimately writes to the clipboard. The endpoint sees PowerShell or mshta launched by the user. If telemetry is not joined across those layers, the attack is invisible.
Shape of the Trend
The technique has three common variants. The fake-CAPTCHA variant displays a "verify you are human" overlay that instructs the user to press Win+R, paste a "verification code," and press Enter. The verification code is a PowerShell or mshta one-liner. The fake-error variant shows a Microsoft-styled error dialog claiming the user's browser must be updated and instructs the same paste-and-run sequence to "fix" it. The fake-Cloudflare variant impersonates a legitimate Cloudflare challenge page and uses the same final paste-and-run pattern.
All three rely on JavaScript on the lure page to write the malicious command to the user's clipboard automatically when the user clicks a button labeled "verify" or "continue." From the user's point of view, they are following dialog instructions. From the defender's point of view, the browser process wrote to the clipboard and the user pasted it into a script host within seconds.
Timeline 2024 → 2026
Public reporting suggests early ClickFix and ClearFake variants appeared in the first half of 2024 and were initially associated with a small number of clusters tracked by Proofpoint and Sekoia. By late 2024, the technique was in widespread use across initial-access brokers and ransomware-aligned operators, with payloads ranging across commodity loaders per public writeups. Through 2025 and into 2026, the variants diversified — the fake-Cloudflare-challenge form gained particular traction in the second half of 2025 per Sekoia and ReliaQuest reporting.
TTPs in Detail
The mechanic depends on three things being true: the lure page must be able to write to the clipboard (a permission most browsers grant on user click), the user must be willing to follow paste-and-run instructions, and a script host (PowerShell, mshta, wscript, conhost) must be available on the endpoint. Public reporting documents pivots into commodity stealers and loaders. Stage-two payloads are operator-dependent and not stable across campaigns, so detection logic that targets the paste-and-run mechanic is more durable than logic targeting any particular follow-on.
The lure pages themselves vary in fidelity. Some are crude and visibly imitations; others are byte-accurate clones of legitimate Cloudflare interstitials. The defender opportunity is not in the page — it is in the cross-layer signal it generates.
What Worked, What Didn't
Email-side controls have not generally caught the technique because the email is often a benign link to a compromised site or an ad-network redirect, with no attachment to scan. URL filtering catches some campaigns when the lure host is known but lags new infrastructure. Browser SmartScreen and SafeBrowsing catch some pages but not enough to be a primary control.
What works is endpoint-side. EDR rules that observe a script host launched by the Run dialog (parent process explorer.exe) with command-line content matching the typical paste-and-run patterns surface the technique reliably. Awareness training also has measurable effect when it specifically teaches the paste-and-run pattern; generic anti-phishing training does not transfer to this case according to multiple defender writeups.
Where It's Heading
Public reporting through mid-2026 indicates the technique is now a baseline capability across initial-access brokers rather than the signature of any one cluster. Defenders should expect it to continue diversifying in lure presentation while remaining stable in mechanic. The endpoint-side detection signature is durable across variants because the clipboard-write-then-run pattern is what makes the technique work; remove that, and the technique no longer functions.
Two 2026 evolutions are worth folding into detections built on this piece. First, the clipboard command itself has moved server-side: analysis of roughly 3,000 live payloads presented at OrangeCon in June 2026 found that the pasted string is now commonly fetched from a token-gated backend that returns a freshly scrambled variant per request, so any single captured command is a sample rather than a signature. Second, operators are shifting the lure instruction from Win+R to Win+X and Windows Terminal, which leaves no RunMRU registry trace and launches the shell under a different parent process. A detection keyed only on the Run dialog will silently miss that path. The dedicated analysis of the API-served delivery model and the Windows Terminal pivot covers both in depth; the practical change here is to widen the initiating-process set beyond `explorer.exe`.
// Hunt for paste-and-run pattern symptom: a script host launched from a
// user-facing shell surface with suspicious command-line content. The
// initiating-process set now includes Windows Terminal, because the
// Win+X pivot leaves no RunMRU trace and does not parent to explorer.exe.
// Pair with browser-side telemetry where available for higher fidelity.
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe", "OpenConsole.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cmd.exe", "msiexec.exe")
| where ProcessCommandLine matches regex @"(?i)(iex|invoke-expression|downloadstring|frombase64string|webclient|move-item|downloads|http[s]?://)"
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName