Malware · · 3 min read
Fake “verify you’re human” pages are installing malware. Here’s the tell.
ClickFix pages pose as a CAPTCHA, then ask you to paste a command. No real check ever does that. How the trick works and what to do if you fell for it.
You open a link, a familiar-looking “Verify you are human” box appears, and then it gives you instructions: press Windows + R, press Ctrl + V, press Enter. Or, on a Mac, open Terminal and paste. That is the whole attack. Security researchers call it ClickFix, and it has become one of the most common ways information-stealing malware gets onto personal computers.
How it works
When you click the fake checkbox, the page quietly copies a command to your clipboard. The “instructions” then get you to paste and run it yourself. Because you ran it, a lot of automated protection never gets a say. The command downloads malware, very often an infostealer, which grabs saved passwords, browser cookies and crypto wallets and sends them off.
Microsoft Threat Intelligence described the technique in detail in August 2025, saying ClickFix campaigns were targeting thousands of devices every day, and that Lumma Stealer was the most common final payload it observed. It found these pages arriving through:
- phishing emails, such as fake invoices or a fake tax authority notice
- malicious ads, including on pirated movie streaming sites
- legitimate websites that had been hacked, where the real page flashes briefly before a fake Cloudflare check covers it
Some versions impersonate Google’s reCAPTCHA, a Discord server invite, or a “document failed to load” error. Microsoft also found ClickFix kits for sale on criminal forums, letting buyers pick a disguise and a language, French included.
It’s still going. In September 2026, Ukraine’s CERT-UA reported a campaign that injected code into more than 100 hacked websites, showing visitors a fake Cloudflare check that installed a stealer called LunexStealer (summary). AhnLab’s monthly infostealer reports for July and August 2026 still list LummaC2, Vidar and others among the stealers being spread most actively.
The tell
No real CAPTCHA, website, bank or government service will ever ask you to paste something into Run, Terminal or PowerShell.
That’s the only rule you need. Real human checks happen inside the page: you tick a box, pick some pictures, or nothing at all. The moment a website asks you to open a system tool and paste, close the tab.
If you already did it
Don’t be embarrassed. These pages are made to look routine, and they work on careful people. Act calmly, in this order:
- Disconnect from the internet (Wi-Fi off) so nothing else is sent.
- Run a full scan with your security software. On Windows, Microsoft Defender’s offline scan is a good start.
- From a different, clean device, change your important passwords: email first, then banking, then everything saved in that browser.
- Sign out of all sessions. Infostealers steal the cookies that keep you signed in, so a new password alone doesn’t kick an attacker out. Most big services have a “sign out everywhere” option. Our guide to session theft explains why this matters.
- Turn on passkeys or an authenticator app where you can.
- If in doubt, reinstall. Some stealers dig in deeply. A clean reinstall is the only way to be sure.
Sources
- Microsoft Threat Intelligence, Think before you Click(Fix): Analyzing the ClickFix social engineering technique, August 21, 2025
- TechJack Solutions, Intelligence briefing on CERT-UA’s LunexStealer report, October 2026
- AhnLab ASEC, July 2026 Infostealer Trend Report
- AhnLab ASEC, August 2026 Infostealer Trend Report
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.