ClickFix: From Fake CAPTCHA to Ransomware, a Reusable Sigma RunMRU Rule

On July 16, 2026, Microsoft documented two distinct intrusion chains built on the same lure: ClickFix. The concept is disarmingly simple, and that is exactly what makes it effective. A web page shows a fake CAPTCHA or a fake error message, then asks the visitor to "prove they are human" by pressing Windows plus R, pasting some text, and hitting enter. That text is a command, and the victim just ran it on their own machine. No booby-trapped attachment, no macro, no unknown binary up front: just a user following instructions.

This technique, tracked as T1204.004 (User Execution: Malicious Copy and Paste), now serves as the entry point for both infostealers such as ACR Stealer and ransomware operations such as Interlock, whose tradecraft CISA detailed in advisory AA25-203A. For an SMB the risk is twofold: a compromised host can have its passwords and session tokens siphoned within minutes, or become the launch point for encrypting the entire estate.

Why ClickFix bypasses classic defenses

The strength of ClickFix is that it moves execution to the legitimate user. The command does not arrive over a monitored network channel, it is typed into the Windows Run dialog. Attachment filtering sees nothing. The email sandbox sees nothing. Antivirus often sees only a PowerShell launched by the current user, which is unremarkable.

The two chains Microsoft observed illustrate the variety of payloads that follow the lure. The first strings together WebDAV, rundll32.exe, PowerShell, and a Python loader. The second goes through mshta.exe, obfuscated PowerShell, and a payload hidden inside an image, a steganography technique. In both cases the goal is identical: steal passwords saved in the browser, cookies, authentication tokens, and sensitive documents.

The stable detection point: the RunMRU key

Trying to detect every final payload is an endless chase. The invariant common to all ClickFix variants sits upstream: when the victim types a command into the Run dialog, Windows records that command in the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. This key keeps the history of commands launched via Windows plus R. A normal user stores cmd, mmc, \\server\share. A ClickFix victim stores a long PowerShell line, often base64 encoded or featuring iwr, Invoke-Expression, curl, a remote path.

Here is a Sigma rule centered on that artifact, portable to any SIEM that ingests registry modification events (Sysmon Event ID 13):

title: Suspicious Run dialog command (RunMRU) matching ClickFix
id: 3d6a9c21-7f04-4b8e-9c2a-1e5f7b0d8a44
status: experimental
description: >
  Detects a RunMRU key write containing remote PowerShell execution markers,
  the typical shape of a ClickFix lure.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: '\Explorer\RunMRU\'
  selection_markers:
    Details|contains:
      - 'powershell'
      - 'pwsh'
      - 'mshta'
      - 'curl'
      - 'iwr'
      - 'Invoke-Expression'
      - 'IEX'
      - 'FromBase64String'
      - '-enc'
      - '-e '
  condition: selection_key and selection_markers
falsepositives:
  - Admins launching PowerShell scripts via Run (rare, to document)
level: high
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001

Backing it with the PowerShell command line

The RunMRU key flags the lure. The second rule targets execution itself, when the pasted command launches an encoded PowerShell. This is T1059.001 (PowerShell). The strong signal is the -EncodedCommand argument (or its short forms -enc, -e) followed by a long base64 string, especially when the parent process is explorer.exe, a sign of launch via the Run dialog rather than an admin terminal.

title: Encoded PowerShell launched from Explorer (post ClickFix)
id: b7e2f4a8-91c3-4d6e-8a1f-5c9d2b7e0a13
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Software deployments launching encoded PowerShell via Explorer
level: high
tags:
  - attack.execution
  - attack.t1059.001

The other binaries to watch in the same chain

Both documented chains rely on signed Microsoft binaries turned against their intended use. mshta.exe is tracked as T1218.005 and rundll32.exe as T1218.011. Once the ClickFix lure is detected, these executions confirm the move to the next payload, as does access to browser credential stores (T1555.003). The ACR Stealer command and control domains observed in these campaigns follow a recognizable generated-name pattern, worth adding as indicators on DNS resolution and proxy logs.

What an SMB can put in place this week

Three measures cut the surface immediately. First, awareness: no legitimate website ever asks you to open Windows plus R and paste a command. That is the simplest red flag to teach non-technical users. Second, restrict PowerShell to the accounts that genuinely need it, via group policy. Third, enable command-line logging in process creation events, without which the rules above receive the event but with an empty CommandLine field.

Detecting ClickFix is not about the final payload, which changes with every campaign, but about the lure artifact, the RunMRU key, which stays stable whatever comes next. That is exactly the approach of the ThreatClaw Sigma feed: rules built on behavioral invariants and the command line, tested against a corpus of legitimate admin usage before release, and shipped with their documented exclusion conditions rather than a bare binary name to ban.