--- title: New phishing campaign hijacks clipboard via fake CAPTCHA... description: Cybercriminals are using fake CAPTCHA interfaces that mimic Cloudflare Turnstile to trick users into executing malicious PowerShell commands. The attack... canonical: https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery | daily.dev og:description: Cybercriminals are using fake CAPTCHA interfaces that mimic Cloudflare Turnstile to trick users into executing malicious PowerShell commands. The attack... og:url: https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh og:image: https://api.daily.dev/og/posts/ina6EFoJH.png og:image:alt: New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Cybercriminals are using fake CAPTCHA interfaces that mimic Cloudflare Turnstile to trick users into executing malicious PowerShell commands. The attack exploits 'verification fatigue' by presenting legitimate-looking security checks that guide users through key combinations (Win+R, Ctrl+V, Enter) to unknowingly run malware. This ClickFix technique delivers information stealers like Lumma and Stealc, as well as remote access trojans, without requiring file downloads. The campaign succeeds by leveraging trusted branding and users' conditioned response to quickly bypass security prompts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery","url":"https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh"},"datePublished":"2025-06-06T12:05:26.758Z","dateModified":"2025-06-06T20:17:28.961Z","description":"Cybercriminals are using fake CAPTCHA interfaces that mimic Cloudflare Turnstile to trick users into executing malicious PowerShell commands. The attack...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c34b222a7fccd57985018420e365fc8b?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c34b222a7fccd57985018420e365fc8b?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-phishing-campaign-hijacks-clipboard-via-fake-captcha-for-malware-delivery-ina6efojh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,phishing,powershell","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"New phishing campaign hijacks clipboard via fake CAPTCHA for malware delivery"}]} ```