# What is a fake CAPTCHA or ClickFix attack?

It is a trick that gets the victim to run the attacker's command themselves. A compromised or fake website shows what looks like a CAPTCHA or an error message, with instructions to prove you are human or fix the problem: press a key combination that opens a command or run window, paste, and press Enter. The page has already copied a malicious command to the clipboard, so the person is in fact launching a script that downloads malware, often an information stealer or a remote-access tool. Because the user runs it, many browser and mail protections never see a file to block. Security researchers, Microsoft among them, have reported a sharp rise in this technique since 2024. Defences: tell staff that no real website ever asks them to paste commands, restrict who can run scripts on ordinary workstations, and keep endpoint protection current. If it happens, treat the device as compromised; on the network, watch for new regular outbound connections from it.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Are e-mail attachments still dangerous?](https://netsenx.com/en/faq/are-email-attachments-still-dangerous)
- [What does NetSenX see after someone clicks a phishing link?](https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click)
- [What is phishing?](https://netsenx.com/en/faq/what-is-phishing)
- [How can you tell that an e-mail is phishing?](https://netsenx.com/en/faq/how-to-spot-a-phishing-email)
- [I clicked a phishing link. What should I do now?](https://netsenx.com/en/faq/i-clicked-a-phishing-link-what-now)