You land on a website and see a familiar instruction: prove you are human. The box resembles a standard CAPTCHA, complete with a security logo. But instead of asking you to select images, it tells you to open a system window and paste a command. That supposed security check could be the attack. A convincing badge or familiar brand name cannot validate the instructions on the page.
This technique, known as ClickFix, shows why an online scam protection service cannot rely solely on teaching people to recognize suspicious logos. Familiar design can be copied, and even legitimate websites can be compromised.
How Fake Verification Turns Into Malware
In a June 2026 warning, the FTC described fake CAPTCHA pages that instruct visitors to run keyboard commands. The steps may paste hidden instructions into Windows and execute software the visitor never intended to install. Sometimes clicking the box silently copies code to the clipboard, so the visitor never sees exactly what will run.
Microsoft’s ClickFix research documented campaigns using bogus human-verification screens to deliver information-stealing malware and remote-access tools. The prompts may imitate well-known services, creating the impression that the command is necessary to finish browsing.
The most dangerous moment is not necessarily the initial click. It is when someone gives an unfamiliar webpage permission, through their own actions, to run code on a computer.
A Familiar Website Is Not a Safety Guarantee
Attackers do not always need a completely fake domain. Microsoft reported an August 2026 TerminalFix campaign that displayed counterfeit Cloudflare-style checks on compromised sites. Victims were directed to run malicious commands, enabling a multistage intrusion and potentially exposing an organization’s wider network.
The deception is not limited to Windows. Microsoft also documented macOS ClickFix campaigns using fake download or verification instructions. The exact screens change, but the tactic remains consistent: a routine-looking fix becomes an invitation to execute malware.
A real CAPTCHA should not require you to open Terminal, PowerShell, or another command interface. Close the page instead of following instructions.
Protection Should Work Before and After the Click
Malicious-site blocking and browser reputation checks can reduce exposure to known attack pages. Updated operating systems, endpoint protection, and application controls add resistance if a harmful page slips through. No single filter catches every newly compromised site, so layers matter. On a work computer, report the prompt to IT before attempting cleanup yourself.
If you already ran a suspicious command, disconnect the device from the internet, run a trusted security scan, and consider professional assistance. Use a different, trusted device to change exposed passwords, review financial activity, and secure important accounts. The FTC’s CAPTCHA guidance recommends rapid action after possible infection. Document what you clicked and when, in case banks or technicians need that information.
We also encourage readers to consider identity theft protection guidance alongside technical defenses. A malware alert is useful, but monitoring for account misuse afterward matters too.
Discuss Practical Online Scam Protection
We believe an online scam protection service should connect threat education with identity-risk awareness and practical support. Learn to Spot Scams is focused around that goal. If you have encountered a suspicious verification prompt or want to understand your protection options, contact us to start a conversation.