ClickFix and SEO poisoning cases from this library, where the victim ends up running the malware themselves. For each one: the trick, what it delivered, and how to avoid it.
ClickFix and SEO poisoning are two ways of getting you to infect your own computer. With ClickFix, a fake error or "verify you are human" box tells you to copy a command and paste it into Windows yourself. With SEO poisoning, a booby-trapped website gets to the top of search results, so when you go looking for a template or a download, you find the attacker's version first.
Key takeaways
| Case | The trick | What it delivered |
|---|---|---|
| GootLoader and law firms, 2021 | Hijacked Google rankings for legal-agreement searches, leading to fake forum "downloads" | Malware loaders, in some cases escalating to REvil ransomware |
| Six law firms, 2023 | Poisoned "agreement" downloads, plus a hacked notary site serving a fake Chrome update | GootLoader and SocGholish; eSentire says it stopped 10 attacks |
| GootLoader returns, 2025 | A comeback in November 2025 after going quiet in spring | New lure pages that impersonate real institutions |
| Fake reCAPTCHA, 2024 | A "verify you are human" page asking victims to paste PowerShell | A rarely seen infostealer Proofpoint called "Lucky Volunteer" |
| Fake AnyDesk site, 2025 | A typosquatted download site with a fake Cloudflare check | The MetaStealer infostealer |
| Fake ChatGPT download, 2026 | Malvertising and search poisoning pointing to openew[.]app | Credential stealers on Windows and Mac |
GootLoader's whole model was built around one habit: people searching for things like "confidentiality agreement template". The operators got compromised sites ranking for exactly those phrases, dressed the page up as a forum thread, and offered a "direct download". In 2021, an insurer's incident team said several legal services firms it covered had been hit with ransomware traced back to it.
ClickFix is the newer one. We all click "I'm not a robot" ten times a week without thinking, and that's the point. Proofpoint wrote up a 2024 case where a fake reCAPTCHA wanted three keystrokes and a paste to "finish verifying". What got pasted was PowerShell. It pulled down an infostealer Proofpoint hadn't seen much of before.
Tip: a CAPTCHA asking you to open the Run box is not a CAPTCHA. Close the tab.
A trick where a fake error or CAPTCHA tells you to copy a command and run it on your own computer. The command installs malware.
Getting a malicious website to rank highly in search results, so people looking for something normal, like a template or a download, end up on the attacker's page.
It went quiet in spring 2025 and came back in November 2025, according to the researcher tracking it. See the 2025 case above.
You mostly can't tell from the link. So don't rely on it: type the maker's address yourself. The fake AnyDesk site in this library was one typo away from the real one.
Reviewed by the SEE Team on 23 October 2026; every case linked here has its sources on its own page.
Social Engineering Examples