The ClickFix Scam: Why a "Verify You're Human" Prompt Might Be Asking You to Run a Command

You've done it hundreds of times: checked a box, solved a puzzle, clicked a button to prove you're not a robot. It's so routine that it barely registers, a half-second interruption between you and whatever you were trying to do. You follow the instructions, you move on, and you never think about it again.

And that's exactly the problem.

A fast-growing cyberattack called ClickFix is now hijacking that automatic, unthinking behavior. It dresses up a dangerous computer command as one of those familiar verification steps, and tricks you into running malware on your own device, no hacking required, no suspicious file to download, no obvious warning sign to catch. The attack works precisely because it looks like something you've done safely a thousand times before.

ClickFix has already become the single most common method attackers use to break into devices in 2025, and it's spreading fast, from opportunistic criminal campaigns to state-sponsored espionage operations. Understanding how it works is no longer optional.

Here's what it looks like, why it works so well, and what you can do to stop it.

What is ClickFix?

ClickFix is a social engineering attack, which means it targets people, not software. Instead of breaking through firewalls or exploiting security flaws in code, attackers simply convince you to do the dangerous work for them, and they've gotten extraordinarily good at it.

The technique first appeared in early 2024, documented by security firm Proofpoint, where threat groups used fake clipboard commands to lure victims into executing malicious code on their own machines. The concept was clever but relatively contained at first. That didn't last long.

Since its emergence, ClickFix has exploded across the threat landscape with a speed that has alarmed security researchers. According to ESET's H1 2025 Threat Report, ClickFix and related fake-CAPTCHA attacks grew by a staggering 517% between the second half of 2024 and the first half of 2025, accounting for nearly 8% of all blocked attacks in that period. To put that in perspective: out of every 13 attacks ESET blocked, one was a ClickFix-style lure.

Microsoft's 2025 Digital Defense Report went further, identifying ClickFix as the #1 initial access method of 2025, responsible for 47% of observed initial compromises, surpassing even traditional phishing emails, which have dominated the threat landscape for decades. Nearly half of all successful device breaches now begin with someone being tricked into running a command they thought was a routine verification step.

The reason for this rapid adoption is straightforward: ClickFix is cheap to deploy, highly effective across a wide range of targets, and remarkably difficult for both humans and security tools to detect in the moment. Criminal groups noticed those advantages early. Nation-state actors followed. The technique has since been adapted, refined, and weaponized at a scale that makes it impossible to ignore.

This isn't a niche threat affecting only the technically unsophisticated. This is the most common way attackers are getting into devices right now, and it works on everyone.

How it works: four steps to a compromised computer

The attack is deceptively simple, which is a large part of why it succeeds. There are no exotic technical components, no zero-day exploits, no elaborate infrastructure required. Just a convincing page, a hidden command, and a set of instructions that sound completely reasonable until you understand what they're actually doing.

Here's what happens when you land on a ClickFix page:

Step 1: You see a convincing fake warning.

The page displays what looks like a standard security check: a Cloudflare human verification screen, a CAPTCHA challenge, a browser error message, or even a Windows Update notice. These overlays carefully copy the exact visual language of trusted brands, the right logos, the right color schemes, the right fonts, the right tone. Many victims later describe them as completely indistinguishable from the real thing. Some ClickFix pages are hosted on legitimate websites that have been compromised, which adds another layer of credibility: the domain itself is trustworthy, even if the page is not.

Step 2: A malicious command is silently loaded onto your clipboard.

While you're reading the on-screen instructions and deciding whether to comply, malicious JavaScript running in the background quietly copies a harmful PowerShell or Windows Run command into your clipboard. You have no idea it's there. There's no notification, no visible change, no indication that anything has happened. The command sits invisibly in your clipboard, waiting.

Step 3: You're guided to paste it and press Enter.

The page then provides step-by-step instructions that sound like a routine technical process. Something like: "Press Windows+R, paste the code below, and click OK to complete verification." Or: "Open PowerShell and paste the following command to confirm you're not a bot." The language is calm, authoritative, and familiar, it mimics the kind of instructions you might find in a legitimate IT support article. What you're actually doing is opening Windows' built-in Run dialog or PowerShell terminal and executing an attacker's command directly on your machine, with your own user permissions.

Step 4: Malware installs in seconds.

Before most antivirus tools can react, the payload runs. The command typically reaches out to an attacker-controlled server and downloads the actual malicious software, which executes immediately. Depending on the campaign and the attacker's goals, that payload could be an infostealer harvesting your saved passwords, browser cookies, and banking credentials; a remote access trojan (RAT) giving attackers a persistent, invisible backdoor into your machine; ransomware that begins encrypting your files within minutes; or cryptomining software that quietly burns through your device's processing power and electricity for someone else's financial gain. In some campaigns, multiple payloads are delivered simultaneously, maximizing the damage from a single successful execution.

The entire sequence, from landing on the page to a fully compromised device, can take less than sixty seconds.

Why it's so hard to catch

ClickFix flies under the radar, not by defeating security tools through technical sophistication, but by routing around them entirely. It exploits a fundamental gap in how most security systems are built: they're built to catch malicious files and suspicious network traffic, not to second-guess commands that a legitimate user runs voluntarily through legitimate system tools.

• No malicious file hits your disk before you act. Traditional antivirus and endpoint protection tools are built to scan files as they arrive on your system. ClickFix never drops a suspicious file for those tools to examine. The malicious command lives only in your clipboard until you paste and execute it yourself, at which point the security tool sees a user-initiated action, not an attack.
• No suspicious link to flag. Secure web gateways and DNS filters work by blocking known-malicious domains. ClickFix delivery pages are often hosted on freshly registered domains with no threat history, or, increasingly, on legitimate websites that have been silently compromised. A university's official website or a well-known software platform's blog can become a ClickFix delivery vehicle without the organization even knowing. The domain reputation is clean because the domain itself is clean.
• You're the one who runs the command. Endpoint detection and response (EDR) tools monitor for unusual process behavior, programs spawning unexpected child processes, scripts running from unusual locations, network connections to suspicious IPs. When you paste and execute a command yourself through a trusted Windows tool like PowerShell or the Run dialog, the system logs it as normal user activity. The behavior looks identical to a system administrator running a legitimate maintenance script.
• The social engineering is polished. Early ClickFix pages were relatively crude. Modern versions are visually sophisticated, grammatically correct, and contextually appropriate, they appear on sites relevant to the content you were already browsing, which makes the verification prompt feel natural rather than suspicious.

As Menlo Security's 2026 State of Browser Security report put it, "the entire chain is built from legitimate system actions, which is exactly what makes it so hard to catch." Security tools are looking for anomalies. ClickFix manufactures normalcy.

Real attacks, real stakes

ClickFix isn't theoretical. It has already hit thousands of victims across the globe through a wide range of real-world campaigns, targeting everyone from individual consumers to large institutions and government entities.

• Fake Cloudflare verification pages have been among the most common and effective delivery mechanisms. Cloudflare's "Checking your browser..." screen appears on millions of websites worldwide, making it one of the most universally recognized, and therefore most convincing, interfaces to impersonate. Victims see a screen they've encountered countless times before and have no reason to question it.
• In May 2026, attackers exploited a critical SQL injection vulnerability (CVE-2026-26980) in the Ghost CMS platform to compromise more than 700 education and technology websites,according to a Malwarebytes investigation, injecting fake Cloudflare verification dialogs directly into the pages of trusted institutions. Universities, research organizations, and technology companies unwittingly became malware delivery platforms. Visitors to these sites had no way of knowing the page they trusted had been tampered with.
• State-sponsored threat actors from North Korea, Iran, and Russia have all been documented testing and deploying ClickFix in targeted espionage campaigns, according to Proofpoint research from April 2025. The technique's effectiveness against even security-aware targets makes it attractive for intelligence operations, not just criminal ones.
• Booking.com phishing campaigns used ClickFix lures combined with fake Cloudflare verification checks to deliver multi-stage malware to targets in the hospitality sector. The campaigns were notable for their precision, emails were crafted to match the exact formatting and language of legitimate Booking.com communications, making the initial lure highly convincing before the ClickFix page even appeared.
• The Lampion malware campaign used ClickFix lures disguised as a Portuguese tax authority portal, delivered through phishing emails containing ZIP attachments. Victims who opened the attachment were directed to a fake verification page that walked them through the same clipboard-and-paste sequence, ultimately installing the Lampion banking trojan on their machines.

The technique has proven so versatile and effective that security researchers have already tracked a successor variant called FileFix, which routes the same fundamental trick through the Windows File Explorer address bar instead of the Run dialog. FileFix specifically targets users who have been trained to distrust the Run dialog prompt, it assumes some security awareness and exploits a different entry point, demonstrating that attackers are actively iterating on the technique in response to growing public awareness.

The breadth of these campaigns (spanning criminal groups, nation-states, multiple industries, and multiple countries) makes clear that ClickFix is not a targeted or specialized threat. It is a general-purpose attack method that works across contexts, and it is being used by virtually every category of threat actor.

The red flags you need to know

The good news: once you know what to look for, ClickFix is surprisingly easy to spot. The attack relies entirely on you not recognizing what's happening. The moment you do, it loses all its power. These are the warning signs that should make you stop immediately, regardless of how legitimate the page looks:

A website asks you to press Win+R, open PowerShell, or open Command Prompt.

This is the single clearest indicator of a ClickFix attack. No legitimate website (not Cloudflare, not Google, not Microsoft, not any CAPTCHA provider) ever needs you to interact with your operating system's command line to verify that you're human. Real CAPTCHAs ask you to click a checkbox or identify objects in images. They operate entirely within your browser. The moment a verification prompt asks you to leave your browser and interact with your operating system, you are looking at an attack.

You're told to copy and paste a code or command.

Legitimate verification steps don't require you to paste anything into your own system. If a page has pre-loaded something into your clipboard or is asking you to copy a string of text and paste it somewhere on your computer, that is not a security check. That is an attack.

There's a countdown timer or urgent language.

Attackers deliberately manufacture time pressure to make you act before your skepticism kicks in. Phrases like "Your session will expire in 30 seconds" or "Complete verification immediately to avoid being blocked" are psychological pressure tactics. A real verification page has no reason to rush you. If you feel hurried, slow down, that urgency is the attack working as designed.

The prompt appeared on a site you don't usually see it on.

Hijacked legitimate websites are now a primary ClickFix delivery method. A domain being trustworthy does not mean every page on that domain is safe. If a site you visit regularly suddenly presents an unusual verification prompt, especially one that asks for command-line interaction, treat it as suspicious regardless of the domain name.

The instructions feel weirdly technical for a simple check.

If you're being guided through a multi-step process that involves your operating system, keyboard shortcuts you don't normally use, or tools you've never heard of, something is wrong. Legitimate human verification is built to be effortless. Complexity is a red flag, not a sign of thoroughness.

What to do if you've already clicked

If you think you may have already followed ClickFix instructions (if you pressed Win+R, pasted something, and hit Enter before realizing what was happening) act immediately. Speed matters significantly in the minutes after an infection occurs.

1. Disconnect from the internet immediately. Unplug your ethernet cable or turn off Wi-Fi right now, before doing anything else. Many ClickFix payloads begin transmitting stolen data or establishing remote access connections within seconds of execution. Cutting the internet connection can interrupt that process and limit the damage, even if it can't undo the execution itself.
2. Don't enter any passwords on that device until it has been professionally assessed and cleared. If an infostealer is running, every credential you type could be captured and transmitted the moment you reconnect to the internet. Use a different, unaffected device to change passwords for your most sensitive accounts, email, banking, and any accounts that share a password with something you use on the compromised device.
3. Run a full scan with a reputable security tool. Be aware that standard antivirus may not catch everything, particularly if the payload was built to evade signature-based detection. Behavioral security tools are more likely to identify suspicious activity.
4. Contact your IT team or a professional. If this happened on a work device, notify your IT or security team immediately, do not wait to see if anything seems wrong. If it's a personal device, consider reaching out to a professional rather than attempting to remediate it yourself. Time matters when an infection has just occurred, and incomplete cleanup can leave persistent backdoors in place.
5. Document what happened. Note the URL of the page where the prompt appeared, the approximate time, and what command you ran if you can remember it. This information can help security professionals understand what payload was delivered and what data may have been exposed.

How to stay protected

Awareness is genuinely your strongest first line of defense against ClickFix, because the attack is built to bypass technical controls. But awareness alone isn't enough, it needs to be paired with habits and tools that provide protection even in moments of inattention.

• Memorize the golden rule: No legitimate website will ever ask you to run a command on your computer. Not for verification. Not for a browser fix. Not for a Windows update. Not for any reason. This rule has no exceptions. If a page asks you to open PowerShell, the Run dialog, or any command-line tool, it is an attack, full stop, regardless of how official it looks.
• Pause before you paste. The urgency you feel when a countdown timer appears or when language suggests your access will be blocked is manufactured. It is a psychological technique, not a real deadline. Deliberately slowing down in those moments, taking ten seconds to ask yourself why a verification page needs you to interact with your operating system, is often enough to break the spell.
• Use security software that monitors behavior, not just files. Standard signature-based antivirus isn't built to catch ClickFix, because there's no malicious file to scan until after you've already executed the command. Look for tools that monitor script execution, clipboard activity, and process behavior in real time, and that can flag suspicious actions even when a user initiates them voluntarily.
• Keep your browser and OS updated. Modern browsers include built-in protections (safe browsing databases, script sandboxing, and phishing detection) that can flag some ClickFix lures before they fully load. These protections only work if your software is current.
• Be especially cautious on sites you trust. The Ghost CMS campaign demonstrated that familiar, reputable websites can be compromised and turned into ClickFix delivery platforms without the site owners' knowledge. A trustworthy domain is not a guarantee of a safe page.
• Share this with people who might not know. Less technically fluent family members, older relatives, and employees who aren't security-focused are among the most vulnerable targets, not because they're careless, but because they have less context for recognizing when something is wrong. One person who understands ClickFix and explains it to five others can prevent real harm. In organizational settings, a single trained employee who recognizes and reports a ClickFix lure can stop a breach that would otherwise cost millions.

Guardio monitors your browser in real time, blocking suspicious scripts and malicious pages before they can load their payloads, including ClickFix lures that standard antivirus tools miss entirely.

The bottom line

ClickFix works because it weaponizes trust. We've all been conditioned to click through verification prompts without reading them carefully, it's a habit that developed because, for years, those prompts were genuinely harmless. Attackers studied that conditioning and built an entire attack category around exploiting it. The result is a technique that feels familiar right up until the moment it isn't.

The numbers reflect how effective that approach has been. ClickFix is now the single most common way cybercriminals gain access to devices, responsible for nearly half of all initial compromises in 2025. It has been adopted by state-sponsored espionage groups from multiple countries. It is showing up on websites that have every reason to be trusted. And it is actively evolving, variants like FileFix are already targeting users who've learned to distrust one entry point by exploiting a different one.

The defense isn't a piece of software. It's a moment of recognition: a website asking you to run a command isn't verifying you're human. It's asking you to compromise your own computer.

Don't give it that chance.

Conclusion

ClickFix succeeds because it exploits trust, not code. Years of clicking through harmless verification prompts trained us not to think twice, and attackers built an entire attack category around that exact reflex.

What makes it dangerous isn't the malware itself, it's the delivery. When the attack runs through your own hands, through trusted Windows tools, on websites you have every reason to believe are safe, it slips past nearly every conventional defense. There's no suspicious file to scan and no malicious link to flag, because you're the one who runs the command.

That's exactly why the fix isn't a piece of software. It's a single habit: the next time a website asks you to open PowerShell or paste something into the Run dialog, treat it as an attack, not a verification step, because that's exactly what it is.

Get started with a free scan today