ClearFake’s fake CAPTCHA campaign shows how malware now evades trust

At a glance

What this is: This is an analysis of ClearFake’s evolving malware campaign and its use of fake CAPTCHA lures, blockchain-hosted payloads, and trusted Windows execution paths to deliver malicious code.

Why it matters: It matters because identity, endpoint, and web controls all have to account for users being tricked into executing attacker commands through trusted system features rather than obvious malicious binaries.

👉 Read Expel's analysis of ClearFake's fake CAPTCHA malware chain

Context

ClearFake is a social-engineering driven malware campaign that turns trusted websites and trusted Windows features into delivery infrastructure. The security gap is not simply malicious code on a page, but the collapse of user trust in what looks like a normal CAPTCHA flow and the limits of controls that rely on blocking known bad domains.

For identity and access practitioners, the interesting part is not only the browser-side lure. It is the way attackers weaponise legitimate system behaviour, from clipboard-pasted commands to proxy execution through built-in Windows tooling, which means the control problem extends beyond web filtering into endpoint execution governance and user interaction boundaries.

Key questions

Q: What breaks when fake CAPTCHA attacks rely on the user to execute the payload?

A: Traditional malware controls lose much of their value when the victim becomes the execution engine. File reputation, attachment scanning, and simple domain blocking can all miss the attack because the code enters through clipboard-pasted commands and trusted Windows utilities. Defenders need controls that watch for the full interaction chain, not just malicious files.

Q: Why do trusted system tools make social-engineering malware harder to detect?

A: Trusted tools create plausible telemetry. When PowerShell, VBS scripts, or browser-driven workflows launch the payload, many EDR and SIEM rules see only normal system behaviour unless command content and process lineage are inspected closely. That is why control design must focus on allowed execution paths, not just blocked binaries.

Q: How can security teams reduce the risk from blockchain-hosted malware payloads?

A: Teams should decide whether blockchain RPC access is actually necessary in their environment and block or tightly broker it if it is not. If it is required, they need egress monitoring, DNS and proxy visibility, and alerts for unusual contract-call patterns so malicious retrieval is not hidden inside legitimate Web3 traffic.

Q: Who is accountable when social engineering turns a user into the execution layer?

A: Accountability sits across security awareness, endpoint engineering, and identity governance. If the control model assumes users will not be manipulated into pasting commands, the organisation has a gap. Frameworks such as NIST SP 800-53 and CIS Controls push teams toward enforceable execution restrictions, not awareness alone.

Technical breakdown

How fake CAPTCHA lures become a code execution path

ClearFake’s ClickFix chain uses a fake CAPTCHA to persuade the user to press Win + R, paste a clipboard payload, and execute it. That matters because the malicious action is initiated by the victim inside a trusted Windows workflow, not by a dropped executable. The browser page first copies command text into the clipboard, then relies on social pressure and familiar interface cues to get the user to run it. This bypasses many controls that focus on downloads, attachments, or obvious malicious binaries, because the initial execution happens through native OS behaviour.

Practical implication: monitor and restrict suspicious use of the Run dialog, clipboard injection, and user-driven execution of script hosts.

Why EtherHiding makes payload takedown harder

EtherHiding stores malicious JavaScript in smart contracts and retrieves it dynamically through blockchain calls. Because the data lives on-chain, defenders cannot simply remove the content the way they would with a normal web host or file repository. The attacker can update the payload by calling the contract’s write function, while victims retrieve the latest version through a public RPC endpoint. This creates a takedown-resistant control plane for malware delivery and reduces the usefulness of traditional domain reputation, since the blockchain and RPC services are legitimate infrastructure.

Practical implication: treat blockchain RPC access as a control point only when Web3 is not required by the business.

How proxy execution and living-off-the-land blur detection boundaries

The campaign’s later stages rely on legitimate Windows components such as SyncAppvPublishingServer.vbs and PowerShell. Rather than launching a clearly malicious file, the attacker abuses a command-injection flaw in a trusted script to execute code indirectly. That is proxy execution, a technique that hides malicious intent inside a normal system utility and often produces telemetry that looks routine unless command lines and parent-child process relationships are inspected closely. Combined with CDN-hosted payloads and in-memory execution, this sharply reduces the value of static blocklists alone.

Practical implication: add command-line inspection, script host restrictions, and PowerShell execution policy controls to detection and prevention layers.

Threat narrative

Attacker objective: The objective is to get victims to execute malware themselves while keeping the delivery chain resilient, updateable, and difficult to block.

1. Entry occurs when a victim loads a compromised website that displays a fake CAPTCHA and prompts them to execute a copied command.
2. Escalation happens when the command chains through trusted Windows script execution or PowerShell, allowing attacker code to run in memory via living-off-the-land techniques.
3. Impact is achieved by delivering malware at scale while evading domain-based blocking, repository takedowns, and many signature-driven security controls.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ClearFake shows that trust abuse is now a delivery architecture, not just a lure. The campaign does not depend on one malicious domain or one infected file. It chains compromised websites, blockchain-hosted payloads, public RPC services, and trusted Windows utilities into a delivery path that looks ordinary at each hop. Security teams should read that as a warning that web, endpoint, and execution controls have to be evaluated as one trust chain, not as separate point defenses.

Proxy execution is becoming the decisive control-evasion pattern in social-engineering malware. The attacker’s advantage comes from making the endpoint run code through a legitimate host process, which weakens detections built around suspicious binaries or downloads. That means endpoint governance must move toward parent-child process scrutiny, script host restrictions, and policy enforcement around native administrative utilities. The practical conclusion is that living-off-the-land behaviour now deserves the same attention as classic malware indicators.

EtherHiding creates a takedown-resistant malware control plane. By moving the payload source into smart contracts, the actor shifts persistence away from a single host or repository and into infrastructure that defenders cannot easily revoke. That is a named concept worth tracking because it combines blockchain immutability with malware agility. For practitioners, this means network controls that only block known-bad domains will miss an important part of the delivery model.

Fake CAPTCHA attacks are no longer just a user awareness problem. The lure works because it exploits the exact behaviours enterprises teach users to trust, including verification prompts and clipboard shortcuts. This is where identity governance intersects with endpoint security: user-facing trust signals can be turned against the organisation when they are used as execution instructions. The implication is that awareness training must be paired with technical friction on risky execution paths.

Domain reputation alone is no longer a reliable prevention strategy for this class of campaign. ClearFake deliberately leans on legitimate infrastructure such as CDNs and public RPC endpoints, which means defenders cannot rely on malicious-domain filtering to catch the full chain. Security programmes should therefore align controls to execution context, not just destination reputation. The result is a stronger case for layered telemetry, browser hardening, and constrained script execution.

What this signals

ClearFake is a reminder that the next generation of malware is optimised for trust abuse rather than obvious malicious infrastructure. For practitioners, that means browser hardening, endpoint execution policy, and egress governance have to be tuned together instead of managed as separate workstreams. The relevant question is no longer whether a domain is bad, but whether the action chain after a user click is acceptable.

Trust-chain execution: this campaign illustrates a governance pattern where each stage looks legitimate on its own, but the combination produces compromise. That is useful for SOC and IAM teams because it shifts detection from single indicators to behavioural sequences across browser, OS, and cloud infrastructure. Align that approach with the MITRE ATT&CK Enterprise Matrix and the CIS Controls v8 for stronger prevention and telemetry design.

For practitioners

• Block or tightly control risky execution paths Restrict use of SyncAppvPublishingServer.vbs and similar proxy-execution utilities unless the business has a documented need. If they must remain available, allow only approved command-line patterns and parent processes, and alert on semicolon-based injection attempts.
• Harden PowerShell execution for non-system users Limit PowerShell usage to approved administrative contexts, then log and alert on interactive launches, encoded commands, and in-memory execution patterns. Where full restriction is impossible, apply application allowlisting and constrain which parent processes can spawn PowerShell.
• Detect fake CAPTCHA execution chains Look for browser sessions followed by clipboard writes, Run dialog launches, and immediate invocation of script interpreters or PowerShell. That sequence is more useful than any single indicator because the social-engineering step is designed to look benign in isolation.
• Treat blockchain RPC traffic as a policy decision If the organisation does not use Web3 services, evaluate whether public blockchain RPC endpoints should be blocked or segmented. If they are needed, route them through monitored egress controls so malicious retrieval patterns can be distinguished from legitimate development use.
• Tune detections for trusted-host abuse Add alerts for command execution launched through trusted Windows components, especially when the command line contains pasted payloads, obfuscated arguments, or unusual child processes. This is the control gap ClearFake exploits most directly.

Key takeaways

• ClearFake succeeds by chaining social engineering, blockchain-hosted payloads, and trusted Windows execution into one evasive delivery path.
• The campaign’s use of legitimate infrastructure means reputation-based blocking and single-point detections will miss important stages of compromise.
• Practitioners need controls that inspect execution context, constrain risky system utilities, and monitor user-driven code execution paths.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• EtherHiding: EtherHiding is a malware delivery technique that stores malicious payloads or payload references in a blockchain smart contract. The attacker uses the chain as a durable retrieval source, which makes takedown difficult and allows payload access without maintaining a traditional server.
• Proxy Execution: Proxy execution is the abuse of a trusted system utility or application to run malicious code indirectly. It hides attacker intent inside normal software behaviour, which weakens security tools that focus on suspicious binaries rather than the process path used to launch them.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.

What's in the full analysis

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact JavaScript infection chain, including the Base64 decoding and blockchain retrieval steps used to load payloads.
• The specific smart contract behaviour behind EtherHiding, including how the set() and get() functions support persistence.
• The full command-injection abuse path for SyncAppvPublishingServer.vbs and the surrounding PowerShell execution logic.
• The infection telemetry and indicators that help investigators map campaign spread and response scope.

👉 The full Expel post covers the blockchain payload flow, command-injection abuse, and mitigation guidance in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners connect governance controls to the wider security programme.