You’ve clicked through hundreds of CAPTCHAs. Check a box, pick out the crosswalks, move on. Hackers know this, and they’re counting on that habit to get you to install malware on your own computer.
The technique is called ClickFix, and it has become one of the most common ways attackers are getting into business networks this year.
How the Scam Works
It usually starts on a real website. Attackers break into legitimate sites, often ones running outdated plugins, and inject code that displays a fake “Verify you’re human” prompt. It looks almost identical to the Google or Cloudflare checks you see every day.
When you click the checkbox, the page quietly copies a malicious command to your clipboard. Then it shows you a short set of “verification steps”:
- Press the Windows key and R.
- Press Ctrl and V.
- Press Enter.
That’s it. Those three steps open the Windows Run box, paste the attacker’s command, and execute it. The page may even let you through to the site afterward, so nothing seems wrong. In the background, malware is downloading.
Why It’s So Effective
Most cyberattacks need to get past your security software. ClickFix sidesteps much of that by getting you to run the command yourself. From your computer’s point of view, a logged-in user typed an instruction and pressed Enter. That looks like normal activity.
It also doesn’t feel like a risk. Nobody is asking you to download a strange attachment or enter your password. You’re just finishing a step you’ve done a thousand times before; on a website you may already trust.
What Gets Installed
The most common payload is an information stealer. These programs grab saved browser passwords, session cookies, and banking details, then send them back to the attacker. Stolen session cookies are especially dangerous because they can let someone into your Microsoft 365 account without ever triggering a multi-factor authentication prompt.
Other versions install remote access tools that give attackers ongoing control of the PC. In a joint advisory, the FBI and CISA warned that the Interlock ransomware group has used fake CAPTCHAs to get its first foothold inside businesses and critical infrastructure organizations across North America.
How to Protect Yourself and Your Team
The single most important rule is simple: no legitimate website will ever ask you to paste something into the Run box, Command Prompt, PowerShell, or Terminal. If a CAPTCHA asks you to press keyboard shortcuts, close the tab.
If you or someone on your team already followed those steps, disconnect the computer from the network and call your IT provider right away. Then change your passwords from a different device.
On the business side, several protections work together to shut this down:
- Security awareness training that shows employees what these fake prompts actually look like.
- Endpoint detection and response (EDR) tools that watch for suspicious commands, even ones a user runs.
- Group policy restrictions that block the Run dialog or PowerShell for employees who don’t need them.
- DNS filtering to stop computers from reaching known malicious sites.
- Conditional access policies in Microsoft 365 that limit the damage from stolen session cookies.
One Keystroke Away
ClickFix is a reminder that the easiest way into a network is often through the people using it. A well-trained team combined with the right security tools makes this scam a lot less likely to succeed. If you’d like to know how well your business is protected, contact Shoreline Technology Solutions for a free network assessment. And if you think someone on your team may have already fallen for one of these prompts, get help now.
President / Network Architect
Mark Kolean always had a fascination with technology from the time he was 3 and his gift of the Atari 2600 to current. In 1990 at the age of 14 Mark got his first job in customer support for a mail order business supporting Tandy TSR-80 computer software shipped on cassette tape. A few years later Mark was building hundreds of 286, 386, and 486 computers for the new emerging DOS & Windows 3.1 computers that had exploded on the market.
After a college career studying business and technology Mark Started Shoreline Computer Systems in 1999 at the height of the dot.com boom with the looming crisis of the year2k bug just around the corner. In the early 2000’s a lot of work was done with early network systems including Lantastic, Novell, and Windows NT Server. Mark became a community contributor to the Small Business Specialist community that revolved around Small Business Server 2000-2011 which focused on single or dual server environments for businesses up to 50 in size. Networks during this time frame mostly had a break fix relationship in which work was billed only when a problem occurred.
In the 2010’s Microsoft released their first cloud based software called Microsoft BPOS which would in later become known as Microsoft Office 365. This introduced a new model in technology with pay as you go subscription services. Starting in 2013 Mark’s team at Shoreline Computer System rebranded as Shoreline Technology Solutions to focus on the transition to become proactive and less reactive to data backup and security needs. Starting in 2018 all customers are required to have a backup management plan in place as a center point with the full understanding that if STS isn’t watching the customer’s data, then no one is.
Now in Mark’s 22 years of business he is building a company emphasis of how to help customers retire servers and build networks completely in the cloud.
