# ClickFix Verification Lure Drives Agent Command Execution

- **Severity:** High
- **Signature ID:** `7c1e4b52-9a3d-4f68-b0c1-2d5e8a4f16b3`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects the 'ClickFix' trick applied to AI computer-use agents: a fake verification, CAPTCHA, or 'human check' message convinces the agent to open a terminal and run an attacker-supplied command. The technique abuses the agent's willingness to 'fix' a broken-looking page or complete a routine-looking check.

## How the attack works

An attacker plants a page or message that mimics a CAPTCHA, bot-check, or broken-content notice, often instructing the reader to press Win+R or open a terminal and paste a line to 'verify' themselves. The AI agent, trying to be helpful and resolve the apparent problem, opens a terminal and pastes the line. That line combines the innocent-looking lure text with a real payload-fetching command — things like PowerShell IEX, encoded PowerShell, mshta pulling a remote script, certutil or bitsadmin downloading a file, or curl/wget piped straight into a shell. The rule also watches for a hidden conhost window used to run the same kind of downloader invisibly. Either pattern alone is common and harmless; the two together on the same command line is the signature of this attack.

## Why it matters

If successful, the attacker gets arbitrary code execution on whatever system the agent's terminal has access to, using the agent's own privileges and trust to launch the payload rather than exploiting a software flaw.

## What you can do

- Restrict or gate AI agents' ability to open terminals or run shell commands without human review, especially in response to on-page prompts.
- Block or alert on command lines that mix verification/CAPTCHA-style wording with download-and-execute syntax (iex, DownloadString, certutil -urlcache, mshta with a URL, curl|bash, etc.).
- Disable or monitor for conhost.exe launched with --headless, since it's not a normal invocation and is strongly associated with this technique.
- Train agent workflows to treat 'paste this to verify you're human' instructions as untrusted content, never as an action to execute.

## Known benign look-alikes

- Detection engineers or malware analysts reproducing a ClickFix payload from an agent-driven terminal in a lab; the security-vocabulary filter suppresses the common triage variants but a bare reproduction of the live payload will still report (this is intended).
- Security-awareness simulations that deliver a real ClickFix lure to a monitored agent.
- Anti-bot / CAPTCHA integration work where a pipe-to-shell installer runs on a command line that also names a CAPTCHA product; the package-manager filter covers the install form, and the CAPTCHA lure pattern additionally requires a verification word within 80 characters.
- IT self-service "paste this to fix it" remediation one-liners that fetch a remote installer; these are genuine copy-paste-to-terminal workflows and are indistinguishable from the attack by content alone, which is why the action is report rather than block.
- An agent writing threat-intel notes containing a quoted ClickFix payload into a document; the detection-content filter suppresses the analyst-notes vocabulary.

## References

- https://attack.mitre.org/techniques/T1204/004/
- https://attack.mitre.org/techniques/T1059/001/

---
Source: https://www.netzilo.com/threats/clickfix-agent-command-execution