social-engineering — PoC Archivehttps://poc.intelseclab.com/pocs/social-engineering/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000ClickFix Social-Engineering Technique — Fortinet-Branded Multi-Stage Lure (Fake File-Access Page + Fake CAPTCHA + Clipboard Injection)https://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-fortinet-lure-multistage/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-fortinet-lure-multistage/High severity — social-engineering · N/A (social-engineering technique, not a software vulnerability). Status: PoC (inert placeholder payload). Affects: Human victims via a browser-rendered phishing lure; end effect targets Windows Run dialog / PowerShell. Tags: clickfix, fake-captcha, clipboard-injection, brand-impersonation, social-engineering, phishing, run-dialog, multistage-lure.social-engineeringHighclickfixfake-captchaclipboard-injectionbrand-impersonationsocial-engineeringphishingrun-dialogmultistage-lureClickFix Social Engineering Technique — Fake Cloudflare Turnstile Just a Moment Verification Lurehttps://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-cloudflare-turnstile-lure/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-cloudflare-turnstile-lure/High severity — social-engineering · N/A (social-engineering technique, not a software vulnerability). Status: PoC (benign placeholder payload). Affects: Human victim / browser + Windows Run dialog (Win+R) — no software vulnerability, this is a social-engineering lure page. Tags: clickfix, fake-captcha, cloudflare-turnstile-lure, clipboard-injection, social-engineering, phishing, run-dialog, multilingual-lure.social-engineeringHighclickfixfake-captchacloudflare-turnstile-lureclipboard-injectionsocial-engineeringphishingrun-dialogmultilingual-lureClickFix Fake-CAPTCHA Social-Engineering Kit with IP Fencing and 19-Language Localizationhttps://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-fake-captcha-ip-fencing-i18n/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-fake-captcha-ip-fencing-i18n/High severity — social-engineering · N/A (social-engineering technique, not a software vulnerability). Status: PoC (benign placeholder payload). Affects: End users of Windows workstations (via Run dialog / PowerShell paste-and-execute); no vulnerable software component. Tags: clickfix, fake-captcha, clipboard-injection, ip-fencing, localization, social-engineering, phishing, run-dialog, cloudflare-worker.social-engineeringHighclickfixfake-captchaclipboard-injectionip-fencinglocalizationsocial-engineeringphishingrun-dialogcloudflare-workerClickFix Fake reCAPTCHA to mshta/HTA Execution Chainhttps://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-recaptcha-phish-mshta-hta/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-27_clickfix-recaptcha-phish-mshta-hta/High severity — social-engineering · N/A (social-engineering technique, not a software vulnerability). Status: Weaponized (educational/benign demo payload). Affects: Human victim / Windows Run dialog (Win+R) or PowerShell/cmd, via mshta.exe. Tags: clickfix, fake-captcha, clipboard-injection, mshta, hta, social-engineering, phishing, run-dialog, recaptcha-impersonation.social-engineeringHighclickfixfake-captchaclipboard-injectionmshtahtasocial-engineeringphishingrun-dialogrecaptcha-impersonationWindows ShellLink (.lnk) Remote Code Execution — CVE-2026-21510 LNK-Stomping Generatorhttps://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21510-lnk-stomping-generator/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21510-lnk-stomping-generator/High severity — social-engineering · CVE-2026-21510. Status: Weaponized. Affects: Windows Shell Link (.lnk) parsing (MS-SHLLINK). Tags: lnk-stomping, shelllink, cve-2026-21510, windows, initial-access, phishing, anti-forensics, red-team.social-engineeringHighlnk-stompingshelllinkcve-2026-21510windowsinitial-accessphishinganti-forensicsred-teamRTF Protected-View Bypass (CVE-2026-21514) Chained with ShellLink RCE (CVE-2026-21510) — Builder Scriptshttps://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21514-cve-2026-21510-rtf-lnk-builder/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21514-cve-2026-21510-rtf-lnk-builder/High severity — social-engineering · CVE-2026-21514, CVE-2026-21510. Status: PoC. Affects: Microsoft Office (RTF/Word rendering + Protected View) and Windows Shell Link (.lnk) handling. Tags: rtf, lnk, ole-object, protected-view-bypass, cve-2026-21514, cve-2026-21510, phishing, initial-access.social-engineeringHighrtflnkole-objectprotected-view-bypasscve-2026-21514cve-2026-21510phishinginitial-access