ClickFix Attacks and the Fake CAPTCHA Your Staff Will Trust

A hacked website shows what looks like a routine CAPTCHA. To "verify" yourself, you are told to copy a line of text and paste it into Windows Run, PowerShell, or the macOS terminal. If someone on your team does that, the machine is infected. As reported by Ars Technica, this technique — called ClickFix — has gone from an oddity to one of the most common ways malware now reaches both PCs and Macs.

What the attack actually looks like

There is no clever exploit involved. The attacker needs three things: a website they have compromised, a fake CAPTCHA overlay, and one terminal command. The victim does the rest.

The overlay often imitates a Cloudflare check, which most people have clicked through hundreds of times. After the user interacts with it, a line of text appears, usually obscured so the malicious part is hard to read. The instruction is to copy it, paste it into the Run box or a terminal, and press Enter.

What makes it work is context. These prompts appear on ordinary sites people have used for years, not on shady corners of the internet. Independent researcher Kevin Beaumont described Reddit filling up with posts from infected users, and legitimate sites being hacked to serve these fake prompts.

Security firm BlueVoyant noted why attackers like it: previously they needed heavy infrastructure — manipulated search results, malicious ads, signed installers, rotating domains. ClickFix removes all of that. Instead of a validly signed installer providing false legitimacy, the user's own decision to run the command provides it. And instead of targeting people searching for one specific piece of software, it reaches anyone who lands on a compromised page.

Macs are not a safe harbour here. Jamf and an independent researcher have documented macOS versions that get around Gatekeeper. Attackers are also hiding their infrastructure in places that are hard to block, including published Google Sheets documents, according to Cisco Talos, and blockchain-based smart contracts. Netskope counted 5,400 sites calling back to one such campaign.

Why it matters for a small business

Most small-business security thinking assumes attacks come as email attachments or dodgy downloads. ClickFix does not. It arrives during normal browsing, on a site the employee trusts, and it asks for something that feels like just another annoying verification step.

That is the real point in the Ars Technica piece: casual users have been trained by years of interstitials, endless picture CAPTCHAs, and shifting interfaces to accept absurd instructions without question. Blaming staff for being gullible does not help and does not reduce infections.

For a company, one infected laptop can mean stolen browser sessions, saved passwords, access to your CRM, your accounting system, your messaging accounts, and whatever customer data sits on that machine. The person most likely to be hit is not your developer. It is the salesperson or the accountant who browses widely and has no reason to know what PowerShell is.

What to do about it this month

• Teach one rule, not a course. No website, ever, has a legitimate reason to ask you to paste a command into Windows Run, PowerShell, or the Mac terminal. If a page asks, close the tab and tell IT. That single sentence covers the entire attack pattern.
• Name the keystrokes. Say it plainly in your staff message: if something tells you to press Win+R, or open Terminal, or paste anything after a CAPTCHA, stop. People remember concrete instructions better than abstract warnings.
• Make reporting safe. Tell your team that if they already pasted something, they should say so immediately and will not be blamed. Shame delays reports, and delay is what turns one infection into a spread.
• Use the tooling that exists. The article points to defences such as uBlock, which has been updated to counter this pattern, and BlockBlock on macOS, which can intervene as soon as the user presses ⌘+V. These are blunt tools, not cures, but they raise the cost for attackers.
• Check what one laptop can reach. Assume a work machine gets compromised. Which systems is it permanently logged into? Where does it hold admin rights? Tightening this limits the damage of any infection, not just this one.

ClickFix is not going away, because it is cheap and it works. There is no patch for it, since nothing is being exploited except a person's willingness to follow instructions. The counter is equally simple and human: make sure everyone on your team knows that a website asking them to run a command is, without exception, an attack.