What is a fake CAPTCHA or ClickFix attack?

It is a trick that gets the victim to run the attacker's command themselves. A compromised or fake website shows what looks like a CAPTCHA or an error message, with instructions to prove you are human or fix the problem: press a key combination that opens a command or run window, paste, and press Enter. The page has already copied a malicious command to the clipboard, so the person is in fact launching a script that downloads malware, often an information stealer or a remote-access tool. Because the user runs it, many browser and mail protections never see a file to block. Security researchers, Microsoft among them, have reported a sharp rise in this technique since 2024. Defences: tell staff that no real website ever asks them to paste commands, restrict who can run scripts on ordinary workstations, and keep endpoint protection current. If it happens, treat the device as compromised; on the network, watch for new regular outbound connections from it.

← All 29 questions on Phishing and e-mail aftermathAll topics