Beyond PowerShell: Analyzing the Multi-Action ClickFix Variant

Reported 23 Apr 2026 by otx · Severity: medium

This analysis documents a newly observed ClickFix variant that abuses native Windows utilities, specifically cmdkey and regsvr32, for payload delivery. Victims are socially engineered through fake CAPTCHA pages to execute a malicious command via the Windows Run dialog. The single