Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them

ClickFix is a social-engineering technique in which victims are presented with a fake error or CAPTCHA that instructs them to copy and paste a command into trusted OS tools (e.g., Windows Run, PowerShell), enabling attackers to execute PowerShell/VBScript chains and deploy malware (CrowdStrike observed GeniexLoader and GeniexRAT). CrowdStrike attributes observed campaigns to STARDUST CHOLLIMA and VOODOO BEAR, documents increases in fake CAPTCHA lures, and recommends defense-in-depth controls spanning browser protection (Falcon Seraphic), endpoint detection/prevention, identity protection, and cross-telemetry correlation.