ClickFix - FakeCaptcha phishing threat analysis + threat research

Important elements of the analysis:

ClickFix Phishing campaign threat
FakeCaptcha
C&C domain and IP address
Multi-stage dropped artifacts
Infostealer threats
Windows Defender exclusion to perform malware detection evasion
CMD and PowerShell executions
Execution environment information collection
Anti-VM and anti-sandbox
cfgmgr32.dll library calls

In the present analysis we will analyze a ClickFix sample compiled on 12th May 2025. The artifact has been developed in C++:

MITRE Matrix:

With the hexadecimal code inspection of the PE we can see evidences related to the development phase and release version of the threat made with the IDE:

With an analysis of the strings extracted from the threat we can see the C&C domain getsveriff[.]com used to download the second stage artifact named "hrjfb.exe". The CMD execution is used to launch a PowerShell execution to exclude from Windows Defender the folder C:\Windows\Temp and the dropped artifact "tybd7.exe". The artifacts downloaded and dropped by ClickFix and FakeCaptcha Phishng threats are usually associated to Infostealer threats.

The sample is generally not packed, the entropy coefficient of the .text section is 6.49102. Here are also the details of the bytes distribution:

The malware performs calls to the functions IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime and IsDebuggerPresent. Those functions can be used to detect virtual machines and sandboxes executions so to perform detonation evasion and anti-VM and anti-sandbox.

Here are others details regarding to the PE, which include the date of compiling, we can see the IDE signature used for the development of the threat Visual Studio 2015:

The entrypoint of the .text section is 0x00009218:

Here are others details about the file sections, including the entropy coefficient of the section .rdata and .rsrc (resources like the manifest file):

Here are the details of the functions called, which include the function used to execute external processes like ShellExecuteExW and to obtain further details about the execution environment it calls the functions GetEnvironmentStrings and GetModuleHandleExW:

The execution level in the manifest file has been set asInvoker:

With a dynamic analysis and debugging session we can see the call to the C&C domain getsveriff[.]com to retrieve the artifact hrjfb.exe

Here is the access to the C:\Windows\Temp folder to do the consequent action of excluding the dropped threat tybd7.exe:

Another evidence about the fact of environment information gathering is the execution of the function EnumSystemLocalesEx, which can be used to get the details and loop through the locales present in the Operating System:

The malware keeps trace of the malicious executions and stages with a Result attribute:

By analyzing a process real-time activity dump we can see evidences associated to calls to the library cfgmgr32.dll, used in the past by Emotet threats to perform C&C connections:

The malware gets information and details about the system settings and customizations via the function GetUserDefaultLCID:

The C&C domain is recognized as malicious by OSINT sources:

Here are the details of the correlations to the downloaders executables (ClickFix fake Captcha Phishing campaign threats) and the artifacts downloading PowerShell scripts: