# ClickFix doesn't attack your knowledge. It attacks your trust.

Compromised university Student Association site served a fake Google CAPTCHA that silently wrote a PowerShell command to the clipboard, harvesting browser credentials and session tokens from 5-10 students.

- Payout: Real-world hack
- Severity: high
- Program: ClickFix
- Analysis by: Toni Dujmović
- Disclosed: 2026-07-16
- Write-up quality: 6/10
- Original: https://www.reversinglabs.com/blog/clickfix-attacks-your-trust
- Library page: https://bugbountylibrary.com/r/blog%3Areversinglabs-com-blog-clickfix-attacks-your-trust
- Tags: area:web domain:web impact:ato impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Compromised university Student Association website serving fake CAPTCHA lure
**Root cause:** Compromised site injected a fake Google verification page whose JavaScript silently overwrote the clipboard with a malicious command; users pasting it into Run/Terminal executed a LOLBaS chain (PowerShell, mshta, curl, rundll32) loading a Go-based RAT in memory.
**Steps:**
1. Victim visits compromised Student Association site and sees a fake Google CAPTCHA/verification prompt.
2. On engagement, JavaScript silently writes a command to the clipboard.
3. Page instructs user to open Win+R or macOS Terminal, paste, and press Enter.
4. Pasted command runs through signed LOLBaS binaries (PowerShell, mshta.exe, curl, rundll32.exe), downloading payload into memory.
5. zuhe.dll (Go-based RAT, three obfuscation layers, 14-sandbox anti-analysis gate) executes inside a legitimate Windows process without UAC.
6. RAT harvests credentials, cookies, session tokens, autofill data, and history from Chromium and Firefox browsers.
7. C2 over multi-channel; same campaign also retrieved payload via Ethereum smart contracts to evade takedown.
**How found:** A friend reported a strange CAPTCHA on a trusted university site; the analyst ran interactive dynamic analysis in Spectra Analyze and observed the clipboard being silently overwritten before any click, revealing the ClickFix mechanism.
**Exploitation:** Watering-hole compromise of a trusted student site; fake CAPTCHA social-engineers the user into executing a clipboard-injected command via Run/Terminal, delivering an in-memory RAT that steals browser sessions and credentials, enabling account hijacking.
**Escalation:** Payload retrieved via Ethereum smart contract queries instead of blockable domains/IPs, making infrastructure takedown-resistant; RAT provides durable access for lateral movement and credential dumping.
**Insight:** ClickFix lures have a stable behavioral fingerprint (fake verification UI + clipboard-writing JS + PowerShell indicators) independent of payload/infrastructure; a multi-condition YARA rule on these structural signals caught 123 lures that evaded all AV engines.