ClickFix Attack: The Fake 'Verify You Are Human' Check That Gets You to Install the Malware Yourself

A ClickFix attack is a fake "Verify you are human" check that asks you to press Win+R, paste and hit Enter. No exploit is needed: you run the malware yourself. It hit 700+ hijacked websites this year, and on 15 October 2026 it hit me.

Below: what the trap looks like, how to spot it in five seconds, and a calm first-hour checklist if you've already pressed Enter. It's fixable, and IT leads and website owners get their own sections.

Want someone to lock this down for your team? That's part of our cybersecurity hardening work.

What is a ClickFix attack, and what does it look like?

A ClickFix attack is a social engineering trick that gets you to run malware yourself. A fake error or "Verify you are human" check silently copies a command to your clipboard, then tells you to press Win+R, paste and press Enter. That command downloads the malware.

Proofpoint named the technique in 2024, when fake CAPTCHA versions were already spreading. Microsoft and Arctic Wolf describe the sequence:

1. You open a normal website, often a real one (a university blog, a clinic, a shop) that attackers have injected a script into.
2. A Cloudflare-style box appears with the logo, a "Verify you are human" checkbox and a spinner. Some copies even show a Ray ID, the reference code real Cloudflare pages display.
3. You tick the box. The page silently copies a command to your clipboard.
4. A "verification step" appears. It tells you to press Win+R, then Ctrl+V, then Enter. Some versions say Win+X then I (which opens Windows Terminal), or ask Mac users to open Terminal.
5. You press Enter. Sometimes a window shows reassuring "Cloudflare validation" messages while the real payload downloads.

Usually the payload is an infostealer that copies saved browser passwords, logged-in session tokens and crypto wallets. In one August 2026 campaign Microsoft documented, it was a tunnel into the victim's internal network.

Am I affected? A 30-second self-check

• Did a website ever ask you to press Win+R, Win+X, or open Terminal or PowerShell? If you only saw the page and closed it, you're almost certainly fine.
• Did you paste and press Enter? Then treat the device as compromised, even if nothing visible happened, and jump to the first-hour checklist below.
• On a work laptop? Tell your IT team now. Reporting fast lets them contain it.
• Do you run a website? It could be the one serving the trap; the last section shows how to check.

What I did when ClickFix hit me on 15 October 2026

On 15 October 2026 I hit a ClickFix page. I backed up my work folder and reset Windows the same day. The next day I rotated every key and credential I had: cloud, database, CMS API keys, email and DNS.

That's the whole story. I'm telling it because "it only catches careless people" is wrong.

The reset was right; what I'd change is the order. Resetting a laptop doesn't un-steal anything, so next time I'd rotate the most important credentials the same day, from my phone, before the reset. I'd also restore documents only, scanned first.

Why ClickFix works on smart people

Proofpoint says ClickFix preys on "people's innate desire to be helpful and independent": you get to fix the problem yourself without bothering IT. Four other forces help.

• Habituation. A 2016 fMRI study by Anderson, Vance and colleagues found the brain's response to a repeated security warning drops with exposure: "from warning to wallpaper". A fake check borrows that autopilot.
• Borrowed authority. The Cloudflare logo and a Ray ID say "this is security, not the site". ThreatLocker says it "turns caution into action": security-conscious users are more likely to stop and carefully follow the instructions.
• A small, easy task. Three key presses feel like nothing, and you never see the command.
• Mild pressure. In the Arctic Wolf campaign, the "Done" button stayed disabled for about 35 seconds, nudging people to finish rather than think.

In Proofpoint's words, it works "by having the person infect themselves".

How to spot a fake CAPTCHA in 5 seconds

The one rule: no real CAPTCHA, and no real Cloudflare check, ever asks you to run anything. Cloudflare's documentation says its challenges at most ask you to tick a box or click a button.

So close the tab if a "verification" page:

• Asks you to press keys like Win+R, Win+X, Ctrl+V or Enter.
• Mentions your clipboard, a "verification code" or a command.
• Asks you to open Run, Terminal, PowerShell or Command Prompt.
• Pops up over the page rather than sitting in it. New Zealand's NCSC notes real checks are embedded in the page.
• Rushes you with a countdown or a disabled button.

The line worth repeating to your team: a real CAPTCHA tests whether you're human; a fake one tests whether you'll follow instructions.

I ran the ClickFix command: what do I do in the first hour?

Stay calm. This is fixable, and speed matters more than perfection. Do these in order.

1. Disconnect the device. Turn off Wi-Fi or pull the cable. Don't sign in to anything else on it.
2. Tell IT or your security provider, if you have one. Microsoft advises assuming the attacker may have network access, so a domain-joined work laptop is everyone's problem.
3. Switch to a clean device (your phone or another computer) for everything below.
4. Change your email password first, then your password manager, bank and work accounts. Email is the reset key for everything else.
5. Sign out all sessions. Stealers take session tokens, which can let an attacker in without your password. Use "sign out everywhere" in key accounts and check for unknown devices or recovery addresses.
6. Rotate keys and secrets stored on or used from that machine: cloud access keys, SSH keys, database passwords, CMS and API tokens, and your domain registrar and DNS logins. Unsure who controls your DNS? Our guide to recovering a website domain explains how to check.
7. Move crypto to a new wallet created on a clean device, if you hold any. Stealers target wallets directly (Arctic Wolf).
8. Then reinstall Windows. Back up documents only, not programs or scripts. A malware scan alone isn't enough: Microsoft found ClickFix payloads setting up scheduled tasks and registry Run keys to restart every hour.

For IT teams: before wiping, note what was run. Windows records Run box commands in the RunMRU registry key (under Explorer\RunMRU in the user's hive), which Microsoft recommends checking during investigation.

The 2026 ClickFix campaigns: a timeline

ClickFix isn't one gang; it's a technique sold as kits. Microsoft reported in August 2025 that kit subscriptions might cost US$200 to US$1,500 a month, and that it saw thousands of devices a month affected, even with endpoint detection and response running.

ESET's H1 2026 Threat Report says ClickFix detections grew 108% between the second half of 2025 and the first half of 2026. The timeline below covers campaigns reported as of 26 October 2026; for the month's other incidents, see our roundup of October 2026 cyber attacks.

Two details matter for defenders. The Arctic Wolf campaign used Windows Installer, not PowerShell, so PowerShell-only rules miss it. And the October cache trick sidesteps the Run box's character limit.

How to protect a team from ClickFix

No single control stops ClickFix, because attackers move to whichever window you haven't locked. Layer these.

Policy. "No website, email or chat message will ever ask you to paste a command. If one does, close it and tell IT." Make reporting blame-free; ThreatLocker stresses that fast reports let IT isolate a machine early.

Disable Run for standard users. In Group Policy, enable User Configuration, Administrative Templates, Start Menu and Taskbar, Remove Run menu from Start Menu, which also blocks Win+R. On Windows editions without the Group Policy editor, the same setting is the NoRun value (a DWORD set to 1) under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer; sign out and back in for it to apply. It doesn't stop other ways of running programs (Microsoft), and Kaspersky warns the Windows 11 search bar can launch PowerShell too.

Restrict PowerShell. Microsoft recommends AppLocker or App Control for Windows for standard users, Constrained Language Mode, script block logging, and Windows Terminal's multi-line paste warning.

Use EDR properly. Turn on web, network and cloud-delivered protection and the attack surface reduction rules that block obfuscated scripts. Watch for msiexec installing from a web address, because Arctic Wolf notes that detections limited to encoded PowerShell miss that step, and remove local admin rights.

Train with variety. The habituation research found warnings that change their look resist being tuned out, so use short, fresh examples, Mac versions included. Since stealers take sessions as well as passwords, moving key accounts to passkeys and shorter sessions limits what they can reuse.

Is my website serving a fake CAPTCHA? How to check

The 700 Ghost sites didn't know they were serving the trap. Attackers used CVE-2026-26980, a SQL injection flaw in Ghost 3.24.0 to 6.19.0, to steal the admin API key without logging in, then injected JavaScript into posts and pages.

Check your own site:

1. Patch your CMS, plugins and themes. For Ghost, that means 6.19.1 or later. Ghost's advisory also says to review staff users and rotate API keys.
2. Look at Google Search Console's Security issues report. It flags hacked content, malware and social engineering Google has found on your site.
3. View the page source from a private window and search for unfamiliar <script> tags, unfamiliar <iframe> elements (the Arctic Wolf campaign injected one into hacked sites), long encoded strings, and clipboard code such as navigator.clipboard.writeText.
4. Check the places scripts hide: your CMS's header and footer code injection fields, theme files, and recently edited posts.
5. Listen to visitors who report a "verify you are human" box your site doesn't use.

If you find one, New Zealand's NCSC says: take the page offline, confirm the infection, remove the scripts and any persistence, verify the site is clean, and tell affected users. Then change every admin password and key. The same habits protect your domain's email; see our DMARC guide.

Frequently asked questions

The bottom line

ClickFix works because it turns a habit into an instruction. The defence is just as simple: a real check never asks you to run anything. Teach that one rule, take Win+R and PowerShell away from people who don't need them, and keep your website patched so it never serves the trap.

The cheapest step is free: send your team the five-second rule today. Want help with the rest? Book a free consultation and we'll review your Windows policies, endpoint protection and website with you, and give you a short list of fixes.

Sources

• Proofpoint, Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape (18 November 2024): https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
• Microsoft Threat Intelligence, Think before you Click(Fix): Analyzing the ClickFix social engineering technique (21 August 2025): https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
• Microsoft Security, TerminalFix campaign deploys a reverse tunnel through multistage intrusion (28 August 2026): https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• BleepingComputer, Microsoft warns of TerminalFix attacks deploying reverse tunnels (31 August 2026): https://www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/
• Infosecurity Magazine, ClickFix Attack Hides VBScript Payload in Browser Cache (6 October 2026): https://www.infosecurity-magazine.com/news/clickfix-vbscript-browser-cache/
• heise online, ClickFix attack campaign relies on Windows Terminal (6 March 2026): https://heise.de/-11202177
• Malwarebytes, 700+ education and tech websites hijacked in huge ClickFix malware campaign (26 May 2026): https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign
• Ghost, SQL Injection in Content API, GHSA-w52v-v783-gw97 / CVE-2026-26980 (16 February 2026): https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97
• Arctic Wolf Labs, The Psychedelic Stealer: When a CAPTCHA Becomes an Installer (24 September 2026): https://arcticwolf.com/resources/blog/psychedelic-stealer-fake-clickfix-captcha-targets-ukraine/
• Security Affairs, ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer (25 September 2026): https://securityaffairs.com/199731/malware/clickfix-campaign-abuses-trusted-websites-to-deploy-psychedelic-stealer.html
• ThreatLocker, Fake Booking.com ClickFix attack abuses Cloudflare verification (23 January 2026): https://www.threatlocker.com/blog/fake-booking-com-clickfix-attack-abuses-cloudflare-verification-to-deliver-malware
• ThreatLocker, Why ClickFix is so effective against security-aware users (20 October 2026): https://www.threatlocker.com/blog/why-clickfix-is-so-effective-against-security-aware-users
• BleepingComputer, New macOS ClickFix attack silently mounts DMGs to push infostealer (23 June 2026): https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/
• ESET, ESET Threat Report H1 2026 (8 July 2026): https://www.eset.com/int/business/threat-report/
• Own Your Online (NCSC New Zealand), Social engineering scam ClickFix using websites to spread malware (2 September 2026): https://www.ownyouronline.govt.nz/news-and-alerts/social-engineering-scam-clickfix-using-websites-to-spread-malware/
• Cloudflare, Cloudflare Challenges documentation: https://developers.cloudflare.com/cloudflare-challenges/
• Kaspersky, ClickFix technique: what it is and why it's dangerous (29 April 2025): https://www.kaspersky.com/blog/what-is-clickfix/53348/
• Microsoft Learn, Remove Run menu from Start Menu (Group Policy reference): https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc940457(v=technet.10)
• Microsoft Learn, Adhering to System Policy Settings (NoRun registry value): https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/adhering-to-system-policy-settings
• Google, Security issues report, Search Console Help: https://support.google.com/webmasters/answer/9044101
• Anderson, Vance, Kirwan, Jenkins and Eargle, From Warning to Wallpaper: Why the Brain Habituates to Security Warnings and What Can Be Done about It, Journal of Management Information Systems 33(3) (2016): https://scholarsarchive.byu.edu/facpub/1955