That CAPTCHA Might Not Be What You Think It Is

You’ve seen CAPTCHAs your whole internet life. Click the traffic lights. Select every image with a bicycle. Prove you’re human. It’s annoying, sure, but you do it without thinking. That’s exactly what cybercriminals are counting on.

A scam called ClickFix, also known as the “fake CAPTCHA” attack, has been making the rounds, and it’s effective precisely because it exploits a habit most of us have built up over years of browsing. You land on a page, you see the familiar CAPTCHA box, and you follow the instructions. Except this time, the instructions are a trap.

Let’s break down exactly how this works, why it’s so dangerous, and what you need to do to make sure you and your team don’t fall for it.

So, What Is the Fake CAPTCHA Scam?

Here’s the setup. You click a link, maybe from a search result or a shared post, and land on a page that looks completely normal. There’s a box asking you to complete a CAPTCHA verification before you can access the content. Makes sense, right? You’ve done this a thousand times.

But instead of showing you a grid of crosswalks, this CAPTCHA tells you to:

• Press Windows + R on your keyboard
• Press Ctrl + V to paste
• Press Enter to confirm

Simple enough, right? Wrong. The moment you landed on that page, it silently copied a malicious command to your clipboard. When you hit Ctrl + V and then Enter, you pasted and executed that command directly into your computer’s Run dialog. You just ran malware. No download prompt. No warning. You did it yourself, and the site is long gone.

Why This Attack Is So Hard to Catch

Most cyberattacks have a tell. A suspicious attachment. A sketchy sender address. A download that sets off your antivirus. ClickFix is different because it bypasses most of those defenses entirely.

Think about it this way. Your security tools are looking for the computer to do something suspicious. But in this case, it’s the user doing it. You ran the command. You authorized it. As far as your system knows, everything is fine.

It also exploits trust. CAPTCHAs are legitimate. We’ve been conditioned to complete them without hesitation. The attackers understand human behavior as well as they understand code, and they designed this to feel familiar, even mundane. That’s the whole point.

What Happens After You Run the Command?

Nothing good. The injected command is typically a PowerShell script, and it can do a lot of damage very quickly. Depending on what the attacker has loaded into it, you might be looking at:

• Credential theft: Saved passwords and browser cookies get scooped up and sent to the attacker
• Infostealer installation: Programs like Lumma or Vidar run silently in the background, harvesting data over time
• Ransomware deployment: In more targeted attacks, the script drops ransomware that can lock down files across your whole network
• Crypto wallet hijacking: If you keep any digital assets, those can be targeted too

These aren’t minor inconveniences. For a business, a single compromised machine can be the entry point for a much larger breach. That’s what makes ClickFix especially dangerous in a workplace setting.

Where Does This Scam Show Up?

The fake CAPTCHA trick can show up almost anywhere online. Some of the most common places include:

• Compromised or copycat websites that mimic legitimate services
• Phishing emails with links to “verification” pages
• Fake Cloudflare security check pages
• Malicious GitHub pages targeting developers
• Fake Microsoft Word or Excel “fix” instructions

This attack saw a significant spike in 2024 and continued into 2025. Security researchers have flagged it targeting everyone from regular home users to software developers and corporate employees. Nobody is off the list.

The Golden Rule You Need to Remember

This one is simple. Say it out loud if you have to.

No legitimate CAPTCHA will ever ask you to open an app, press keyboard shortcuts, or run a command.

Real CAPTCHAs live entirely inside your browser. They ask you to click images or solve a puzzle. That’s it. The moment a “verification” step asks you to touch your keyboard in any way beyond typing or clicking, something is very wrong.

What to Do If You Already Fell for It

First, don’t panic. But do move fast.

• Disconnect from the internet immediately, either by pulling the ethernet cable or turning off Wi-Fi
• Do not log into any accounts from that machine until it has been checked
• Run a full malware scan using a trusted security tool
• Change passwords for any accounts accessible from that device, starting with email and banking
• If this happened on a work computer, notify your IT team right away

Speed matters here. The sooner you isolate the machine, the less damage the attacker can do.

How Businesses Can Protect Their Teams

Individual awareness is important, but it’s not enough on its own. Organizations need layers of protection in place. Here’s what that looks like in practice:

• Security awareness training that specifically covers social engineering tactics, not just phishing emails
• Endpoint detection and response (EDR) tools that can flag unusual PowerShell activity
• Restricting PowerShell access for users who do not need it
• DNS filtering and web content controls to block known malicious domains
• Regular simulated attacks to test whether your team recognizes these scenarios in real life

Attackers are getting more creative. The tools defending against them need to keep pace. Relying on employees to self-detect every threat is not a strategy. It’s a hope.

The Bottom Line

The fake CAPTCHA scam is not going away. It’s too effective, too simple, and too well-disguised for attackers to abandon it. What can change is how prepared your people and your systems are when they encounter it.

If a verification step ever tells you to open your Run dialog, paste something, or execute a command, close the tab. Walk away. Then tell someone about it.

And if you’re not sure whether your organization has the right defenses in place to catch attacks like this one, that’s a conversation worth having. Gibraltar Solutions works with businesses to assess real-world vulnerabilities and build security programs that actually work. Reach out to our team to get started.