A sophisticated social engineering campaign, dubbed “ClickFix,” emerged earlier this year, targeting organisations within the property and insurance sectors. By exploiting CAPTCHA verification prompts, this attack tricks users into executing malicious code via the Windows Run dialog — a novel vector that evades traditional detection mechanisms.

This 19-page technical report offers a comprehensive, granular analysis of the ClickFix attack chain, including:

• In-depth breakdown of each infection stage, from initial compromise through to payload execution

• Detailed examination of malware behaviour and persistence leveraging in-memory execution techniques

• Visual attack chain mappings and analysis of Tactics, Techniques, and Procedures (TTPs)

• Code snippets and Indicators of Compromise (IoCs) to aid proactive detection

• Detection strategies and mitigation recommendations based on real-world incident data