Signal file // INC-004Severity // HighConfidence // Confirmed

Public-safe true-positive investigation · Social engineering

ClickFix attack initiated through a fake CAPTCHA

Confirmed malicious activity

Public-safe case study Customer names, domains, employee identifiers, exact user addresses, internal evidence locations, and case-specific identifiers have been removed or replaced. Quantitative findings and defensive lessons are retained for educational use.

Executive assessment

At 11:06 UTC, a user browsing a compromised supplier portal encountered a fake “Verify you are human” CAPTCHA. The page seeded a command into the clipboard and instructed the user to press Windows+R, paste, and execute it. RunMRU, browser history, process ancestry, PowerShell logging, DNS, proxy, and file-access telemetry reconstruct a seven-stage ClickFix chain that retrieved an information-stealing payload and accessed three browser data stores. The workstation was isolated 8 minutes 52 seconds after command execution.

1Affected workstation

7Correlated stages

3Browser stores accessed

15,306Peer endpoints searched

95% autonomous investigation. 100% human authority.

TandemTrace AI agents completed 38 of 40 recorded investigation actions autonomously. The human analyst retained the two consequential decisions: final verdict approval and containment authorization.

Investigation ownership

Agents did the investigative work. The analyst made the judgment calls.

95% AI agents

38Autonomous actions2Human decisions

Investigation stageAIHuman

Evidence collection120

Enrichment70

Correlation and timeline60

Hypothesis testing80

Scope and prevalence50

Verdict approval01

Containment authorization01

Agent-to-human handoff

Orange = AI · black diamond = human · green = response

11:06:14Agent collected process ancestry and remote-HTA evidence.

11:06:31Agent joined browser history, clipboard timing, and RunMRU.

11:07:02Agent reconstructed the mshta → PowerShell → regasm chain.

11:08:43Agent identified browser-store access and bounded possible impact.

11:09:18Agent searched 15,306 peer endpoints and tested competing hypotheses.

11:12:08Agent assembled the evidence-backed true-positive recommendation.

11:12:21Human analyst approved the true-positive verdict.

11:14:38Human analyst authorized endpoint containment.

11:15:04Endpoint isolation completed.

Investigation dataset

Case context

Alert source: EDR · Suspicious Run-dialog execution
First observed: 2026-07-28 11:06:12 UTC
Host: WKSTN-OPS-073 · Windows 11 23H2
Identity: m.chen · Supply Operations
Arrival: Compromised supplier portal · fake CAPTCHA

Telemetry reviewed

Endpoint: 2,982 process/file/registry events · ±45 minutes
Browser: 94 history and download records · 24 hours
PowerShell: 27 operational events · 4 script blocks
Network: 11 DNS queries · 5 proxy sessions
Prevalence: 15,306 endpoints · 30-day lookback

chrome.exePID 6224 · lure page

→

explorer.exePID 4100 · Run dialog

→

mshta.exePID 9188 · remote HTA

→

powershell.exePID 9440 · hidden stage

→

regasm.exePID 9704 · CLR payload

Artifact	Sanitized value	Prevalence	Assessment
Lure domain	`supplier-check.invalid`	1 user / first seen	Reserved replacement
RunMRU command	`mshta hxxps://…/verify.hta`	1 host	User-executed launcher
Payload SHA-256	`73bf…c908`	1 / 15,306 hosts	Unique in-memory assembly
Destination	`203.0.113[.]64:443`	0 prior connections	Sanitized TEST-NET value

Visual investigation brief

Original detection

EDR alert · rule v3.7

Alert IDEDR-CF-4917

Detected11:06:14 UTC

RuleRemote HTA from Run dialog

HostWKSTN-OPS-073

Processmshta.exe · PID 9188

Initial severityMedium · 64/100

Investigation funnel

2,982 → 1

2,982Endpoint events reviewed

86Events in execution window

27PowerShell events

10Corroborating signals

1Confirmed incident

ClickFix interaction chain

Human-assisted execution

Compromised siteSupplier portal
11:05:44

Fake CAPTCHA“Verify you are human”
11:06:02

Clipboard seededCommand copied
11:06:08

Run dialogWin+R · paste · enter
11:06:12

Remote HTAmshta.exe
11:06:12

PowerShell stageHidden retrieval
11:06:14

Data accessBrowser stores
11:08:31

Evidence confidence matrix

Cross-source support

Finding	Endpoint	Browser / RunMRU	Network	Confidence
ClickFix user interaction	✓	✓	—	Confirmed
Remote code retrieval	✓	Context	✓	Confirmed
Payload execution	✓	—	Context	Confirmed
Browser-data access	✓	✓	—	High
Successful exfiltration	Partial	—	Partial	Unconfirmed

Initial alert

One suspicious mshta process

Remote HTA execution
One host identified
User intent unknown
Payload and impact unknown

→

Completed investigation

Confirmed ClickFix chain

Fake CAPTCHA and RunMRU joined
Seven stages reconstructed
Three browser stores accessed
15,306 endpoints searched

Multi-source timeline

11:05–11:15 UTC

Browser

RunMRU

Endpoint

Network

Response

11:0511:0711:1011:1211:15

Evidence that changed the verdict

Browser-to-clipboard sequence

History placed the user on the fake verification page 28 seconds before RunMRU recorded the sanitized remote-HTA command.

User-mediated launcher

explorer.exe spawned mshta.exe without an originating shell or management process, matching Run-dialog execution.

Living-off-the-land chain

The HTA launched hidden PowerShell, which loaded a .NET assembly into regasm.exe without a normal registration workflow.

Information-access behavior

The injected process opened browser Login Data, Cookies, and Web Data stores in rapid succession outside browser context.

Correlated timeline

11:05:44 · Arrival

User reaches the compromised supplier portal from a search result.

11:06:02 · Fake verification

Page displays a CAPTCHA-style prompt and scripted remediation steps.

11:06:12 · Command executed

RunMRU records the clipboard-seeded remote HTA command.

11:06:14 · Downloader chain

mshta launches hidden PowerShell and retrieves two staged responses.

11:08:31 · Browser data access

Injected process reads three browser stores and creates an encrypted staging file.

11:15:04 · Host isolated

Network containment completed; session and credential response initiated.

Competing hypotheses tested

Hypothesis	Test	Disposition
Legitimate support workflow	Compared RunMRU command, portal content, helpdesk tickets, software management, and signer context.	Rejected: no approved workflow uses remote HTA or hidden PowerShell.
Administrator troubleshooting	Reviewed user role, parentage, change window, peer commands, and management tooling.	Rejected: standard user, no ticket, unique command chain.
ClickFix social engineering	Joined lure page, clipboard timing, RunMRU, mshta, PowerShell, network, and browser-data access.	Confirmed.

Confirmed scope and uncertainty

Confirmed by evidence

Fake CAPTCHA interaction and command execution occurred on one workstation.
Remote HTA, PowerShell, CLR payload, and browser-data access are confirmed.
Three browser stores were opened and a 6.7 MB encrypted staging file was created.
No matching chain appeared across 15,306 peer endpoints.

Not yet confirmed

Proxy telemetry cannot prove the staging archive completed upload.
Decrypted browser secrets were not recovered from memory.
The compromised website entry mechanism remains outside available evidence.
No actor or malware-family attribution is made.

Containment and follow-up

Isolate and preserve

Maintain isolation and preserve browser history, RunMRU, PowerShell, memory, HTA, and staging artifacts.

Reset exposed access

Revoke sessions, rotate passwords, and invalidate browser-stored enterprise tokens associated with the user.

Block and hunt

Block the lure and payload infrastructure; hunt for RunMRU command fragments, ancestry, hashes, and browser-store access.

Reduce recurrence

Restrict unnecessary Run dialog and mshta use, strengthen application control, and train users never to paste verification commands.

Technical evidence and response

Run-dialog reconstruction

Clipboard → RunMRU → process

Time UTC	Source	Observation	Contribution
11:06:08.410	Browser script telemetry	Clipboard-write event on verification page	Command placement
11:06:12.086	Registry RunMRU	Remote HTA command inserted as most recent entry	User execution evidence
11:06:12.391	EDR process	explorer.exe → mshta.exe	Run-dialog parentage
11:06:14.028	PowerShell 4104	Hidden staged retrieval	Downloader confirmed

Download and staging waterfall

Sanitized network evidence

11:06:13GET /verify.hta200

7.8 KB · launcher

11:06:15GET /stage200

164 KB · loader

11:06:19GET /module200

692 KB · assembly

11:09:02POST /gate200

41 KB · inconclusive

RunMRU queryCommand contains remote HTA fragment · 30d

Registry1 host

Process queryexplorer → mshta → PowerShell → regasm

EDR1 host

Browser access queryNon-browser process opens Login Data / Cookies

EDR · 24h1 host

Impact queryToken replay · anomalous sign-in · lateral movement

Identity + SIEM0 matches

Negative evidence reviewed

Absence tested—not assumed

Question	Sources / window	Result	Meaning
Did the chain execute elsewhere?	EDR + RunMRU · 15,306 hosts · 30d	0 additional	Scope remains one host
Were browser tokens replayed?	Identity and SaaS audit · 24h	0 anomalous	Misuse not observed
Was lateral movement attempted?	SMB, RDP, WinRM, service creation · 24h	0 matches	No confirmed lateral movement
Was the archive uploaded?	Proxy sessions · event window	Inconclusive	Cannot claim no exfiltration

Response status

Closing review

Endpoint isolatedComplete · 11:15

User sessions revokedComplete · 11:18

Credentials rotatedComplete · 11:46

Enterprise huntComplete · 15,306

Archive upload verificationTelemetry gap

Website compromise causeExternal scope

Evidence ledger

Sanitized chain of evidence

ID	Source	Event UTC	Collected	Entity	Verdict contribution
C-01	Browser history	11:05:44	11:18:02	Lure page	Arrival and lure
C-02	RunMRU	11:06:12	11:16:31	Remote HTA command	User execution
C-03	EDR	11:06:12	11:06:14	mshta.exe	Launcher confirmed
C-04	PowerShell 4104	11:06:14	11:06:16	Stage retrieval	Downloader confirmed
C-05	EDR file access	11:08:31	11:08:35	Browser stores	Impact established

MITRE ATT&CK mapping

Technique	Observed behavior
T1204.004 · Malicious Copy and Paste	User followed fake verification instructions and executed clipboard content.
T1218.005 · Mshta	Remote HTA launched through a trusted Windows binary.
T1059.001 · PowerShell	Hidden PowerShell retrieved and invoked follow-on stages.
T1105 · Ingress Tool Transfer	Loader and CLR module transferred from external infrastructure.
T1218.009 · Regsvcs/Regasm	CLR payload executed inside regasm.exe.
T1555.003 · Credentials from Web Browsers	Non-browser process accessed Login Data, Cookies, and Web Data stores.