Inside ClickFix: How Fake CAPTCHAs, Blockchain and WebRTC Deliver Malware

When you visit a legitimate small‑business website, you may see a familiar CAPTCHA. In the ClickFix campaign the box is replaced by a prompt that tells Windows users to open the Run dialog and paste a command. That command downloads and launches the attacker’s malware.

Netskope Threat Labs has catalogued more than 5,400 compromised sites belonging to over 2,200 organisations worldwide. Hundreds of these sites are active on any given day, and the lab observed over 300 sites contacting the malicious infrastructure each weekday.

The malicious code is first hidden inside the compromised page. When a visitor loads the page, the code injects a secondary script that blurs the page and displays the fake CAPTCHA. The technique is called ClickFix.

Instead of storing the payload on a traditional web server, the attackers keep the next‑step instructions in a smart contract on the BNB Smart Chain test network. The compromised sites query this contract to retrieve the latest commands, allowing the criminals to change the payload without touching each hacked site.

Netskope researchers also found that the attackers abuse WebRTC, a browser feature normally used for video calls, to open an encrypted peer‑to‑peer channel. Through this channel they push additional malicious code directly into the victim’s browser, bypassing the need to write a file to disk.

Because the fake CAPTCHA asks you to run a command, the simplest defence is to remember that a genuine CAPTCHA never requires you to open Windows Run, PowerShell or any command prompt. If you see such a request, close the page immediately and run a security scan.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Práctica de escucha