ClickFix tactic: Revenge of detection – Detect Fake CAPTCHA

## Executive summary This report describes the ClickFix social-engineering tactic—fake video-conference or CAPTCHA pages that instruct users to paste and execute malicious mshta or PowerShell commands—used to deliver infostealers and other malware; it documents infection chains for Windows and macOS, provides behavioural and network detection ideas (Sigma-like rules and correlation strategies), and notes uptake by multiple intrusion sets including TA571 and a chain attributed to APT28.