ClickFix: The Fake CAPTCHA Attack Tricking Employees Into Infecting Their Own PC

Most employee security training still centers on one message: don't open suspicious attachments, don't click strange links. ClickFix doesn't send an attachment and doesn't need a click on a link to a malicious download. It sends someone to a webpage that looks like an everyday annoyance, a CAPTCHA, a "your browser needs an update" notice, a broken Zoom or Google Meet invite, and then talks them through infecting their own machine one copy-paste at a time. It's become one of the fastest-growing ways attackers get an initial foothold in 2026, precisely because it turns the employee into the one who runs the malware, not the attacker.

How a ClickFix attack actually works

The victim lands on a compromised or malicious page, often via a search result, a malicious ad, or a link in an email or text message. Instead of an obvious phishing form, the page shows something mundane: a CAPTCHA that "failed to load automatically," a Cloudflare-style human verification check, or a popup claiming a video call can't connect until an error is fixed. Each version ends the same way: instructions to press Windows key + R, paste a block of text already copied to the clipboard, and hit Enter. That text is a PowerShell or `mshta` command that reaches out to a remote server and pulls down the real payload, often an info-stealer, a remote access tool, or a loader for ransomware. Nothing about the process looks like a file download. The employee opened a built-in Windows tool and typed nothing themselves; they just followed instructions that felt like clearing a routine glitch.

Why this matters for a small business

• It bypasses the defenses built for attachments and links. Email filters, attachment scanning, and safe-link rewriting all target a different delivery method. ClickFix doesn't deliver a file until after the victim has already run the command themselves.
• It uses tools already on the machine. PowerShell and `mshta.exe` are legitimate Windows components IT relies on every day, which makes the first stage of the attack look like normal system activity to basic antivirus.
• It preys on a "fix the annoyance" instinct. A CAPTCHA that won't load or a call that won't connect is exactly the kind of low-stakes friction employees are used to clicking through without a second thought.
• The payload varies, and none of the options are good. Depending on the campaign, what lands is a password and session-token stealer, a remote access trojan, or a loader that hands off to ransomware operators, so the blast radius isn't limited to one type of damage.

What actually stops it

• DNS and web filtering that blocks known malicious and newly registered domains before the fake CAPTCHA page ever finishes loading, cutting the attack off before an employee sees the prompt.
• EDR with behavioral detection, not just signature-based antivirus, tuned to flag unusual process chains like a browser or Explorer window spawning PowerShell with an encoded, base64-style command.
• Restricting PowerShell execution policy and script execution for standard users where the business role allows it, so a pasted command has less room to run unimpeded.
• A specific, named training example, not just generic "don't click suspicious links" advice: no legitimate CAPTCHA, software update, or meeting fix ever asks a person to open Run and paste anything.
• A clear reporting path with no blame attached, so an employee who did paste and run a command tells IT immediately instead of quietly restarting the machine and hoping it goes away.

Where this fits

• The EDR vs. antivirus post, for why behavioral detection catches what signature scanning misses on an attack like this.
• The OAuth app phishing post, for another technique built to skip malware files and detection entirely.
• The browser extension security post, for the related risk of browser-based attacks that don't touch email at all.
• The phishing simulation post, for how to build ClickFix-style scenarios into ongoing employee training instead of a once-a-year slideshow.
• The cybersecurity page, for where filtering, EDR, and training fit into a full security program.

FAQs about ClickFix attacks

What is a ClickFix attack?

ClickFix is a social engineering technique where a fake webpage, often disguised as a CAPTCHA, a Cloudflare verification check, or a Zoom/Teams error message, instructs the visitor to open the Windows Run dialog, paste a block of text, and press Enter. The pasted text is actually a PowerShell or command-line instruction that downloads and runs malware. It works because the victim performs every step themselves, so there is no attachment, no exploit, and no macro for security software to flag.

Can antivirus or EDR stop a ClickFix attack?

Antivirus alone usually cannot, because nothing malicious touches the disk until after the victim pastes and runs the command themselves, and the initial payload is often a legitimate system tool like PowerShell or mshta.exe rather than a foreign executable. Modern EDR with behavioral detection has a much better shot, since it can flag unusual process chains such as a browser or explorer.exe spawning PowerShell with an encoded command. The most reliable stop is earlier in the chain: blocking the fake page itself and training employees never to paste anything into Run at a website's instruction.

What should an employee do if a website asks them to open Run and paste a command?

Close the tab and don't paste anything. No legitimate CAPTCHA, software update, or video-call error ever requires opening the Windows Run dialog or a terminal and pasting text to "verify" or "fix" anything; that step exists in exactly zero real Microsoft, Google, Zoom, or Cloudflare workflows. If a laptop already had a command pasted and run, disconnect it from the network and report it immediately so IT can check for persistence, rather than assuming a restart cleared it out.