Executive Summary
A recent surge in ClickFix attacks demonstrates a standardized social engineering trick—posing as fake CAPTCHA or browser verification prompts—to deliver highly diverse and sophisticated payloads. These campaigns leverage the Windows 'Run' dialog (Win+R) to execute malicious PowerShell commands. Notable findings include the discovery of 'CrashHandler RAT,' which uses a Google-signed utility to disable Microsoft Defender, and a novel campaign that abuses the Stripe API as a covert two-way command-and-control (C2) channel.
While some payloads observed were benign (e.g., launching Calculator), the underlying infrastructure remains under attacker control, posing a persistent threat. The primary objective for most of these attacks remains the deployment of infostealers like LummaStealer to exfiltrate credentials and session tokens, which are subsequently traded in underground marketplaces. Organizations across retail, finance, and gaming sectors are actively targeted through lookalike domains and typosquatting.