Fake CAPTCHA (ClickFix) Scam

ClickFix flips the usual malware playbook: instead of tricking you into clicking a bad file, it tricks you into running the malicious command yourself — which is exactly why it slips past antivirus. **The Setup:** 1. **The bait.** You land on a page — often through a poisoned ad, a hacked site, a phishing email, or a high-ranking search result — and see what looks like a normal CAPTCHA: "Verify you are human." Sometimes it's dressed up as a "fix this error" or "your browser needs updating" message. 2. **The "fix."** A prompt says the verification failed and you must complete "a few quick steps." There's usually a button like "Fix It," "How to Fix," or "I'm not a robot." Clicking it silently copies a command onto your clipboard — but installs nothing yet. 3. **You run it.** A pop-up walks you through pressing **Windows + R** (the Run dialog), then **Ctrl + V** to paste, then **Enter**. What you can see in the box reads something harmless like "I am not a robot" — but that's only the tail end of the text. The real command is hidden in front of it. 4. **The payload.** Pressing Enter runs a PowerShell command that quietly downloads and installs malware. From there, attackers can steal your passwords and crypto, drain accounts, watch your screen, or drop ransomware. **Why it works so well:** - **You do the dirty work.** Because you type and run the command yourself, there's no malicious attachment for email filters or antivirus to catch — in its first stage nothing is even written to disk. - **It abuses trusted tools.** It uses built-in Windows utilities (PowerShell, the Run box), so security software sees "normal" activity. - **MFA doesn't save you.** The attack hits your device, not your login, so even phishing-resistant two-factor authentication offers no protection. - **It feels routine.** CAPTCHAs are everywhere, so a fake one doesn't raise alarm — that familiarity is the whole trick. **The scale:** ESET recorded a 517% jump in ClickFix attacks in the first half of 2025, making it the second most common attack vector behind conventional phishing. Microsoft's 2025 Digital Defense Report tied 47% of observed initial compromises to the technique, and Recorded Future assessed it would remain the dominant initial-access method through 2026. In June 2026 both the FTC and Google issued public warnings about it.