ClickFix: The Fake CAPTCHA Attack Behind Win+R and Ctrl+V

In January 2017, this page warned about a phone scam: a stranger claiming to be "Microsoft support" would talk you into pressing Win + R and reading out what your own computer showed you, as proof it was infected. Nine years later that scam has dropped the phone call, dressed itself up as a CAPTCHA, and become — by Microsoft’s own tracking, as reported in January 2026 — the technique behind roughly 47% of the break-ins they observe. It is called ClickFix, and it looks like nothing at all: a normal "Verify you are human" box on a normal-looking website, with one extra step — press Win + R, then Ctrl + V, then Enter. Do those three keystrokes and you have personally executed a command the website silently copied to your clipboard, and no antivirus download-warning ever fired, because nothing was downloaded — you typed the burglar in yourself. One rule defeats the whole category, and it is worth saying above everything else: no real verification, on any legitimate website, will ever ask you to press keys outside your browser. Ever. A CAPTCHA that mentions Win + R, the Run box, PowerShell, or a terminal is not testing whether you are human. It is testing whether you will follow instructions.

Jake met his one on a parts-supplier site he has used for years — which is the detail worth sitting with, because nothing about the site was fake. Real supplier, real catalog, hijacked for an afternoon: in May 2026, Malwarebytes counted more than 700 legitimate education and technology websites serving this exact trick after being compromised. Between him and the price list stood a neat little box: a Cloudflare-style logo, "Verify you are human," a checkbox — and then a second screen: "Verification steps: 1. Press Windows + R. 2. Press Ctrl + V. 3. Press Enter." Jake’s thumb was on the Windows key when nine years of muscle memory kicked in — he had read the 2017 version of this very page — and he stopped, called Ethan, and asked the exact right question: "Why would a website need my Run box to know I’m human?"

Ethan: "It doesn’t, and that’s the whole scam in one sentence. Think of it like this: a stranger can’t open your front door — the locks are good now. Browsers block their downloads, Defender scans their files, warning banners fire. So instead, the stranger slips a sealed note under the door and asks you to read it aloud to your voice-controlled lock. You did the breaking in. Every security system in the house watched you do it and stayed quiet, because the homeowner is allowed to open the door. ClickFix is that note. The genius — and I hate that it is genius — is that the victim supplies the one thing malware can’t fake: a human hand on the keyboard, acting voluntarily."

How does a ClickFix attack work? Step by step

The page you see — fake CAPTCHA, fake error, fake "update needed" — is running a small piece of JavaScript with one job: the moment you click the checkbox or button, it silently writes a command to your clipboard. You never see the command. Then the page shows you the "verification steps," which are really an execution recipe: Win + R opens Windows’ Run dialog (a box that executes whatever is typed into it), Ctrl + V pastes the hidden command, and Enter runs it. The command is typically a one-liner for powershell or mshta — a legitimate Windows tool told to quietly fetch and run the real payload from the attacker’s server. Ten seconds later the box closes, the fake CAPTCHA cheerfully says "Verified!", and an infostealer is already reading your browser.

Understand why this design took over, because it explains the defense. Traditional malware has to get past the browser’s download warnings, SmartScreen’s reputation checks, and the antivirus scan that greets every saved file — a gauntlet built up over twenty years. ClickFix skips the entire gauntlet: no file is downloaded through the browser at all. A human, using their own account, ran a built-in Windows tool by hand — which is what administrators do all day, and what security software is specifically designed not to panic about. The scam’s only weakness is that it cannot press the keys itself. The clipboard write is silent, but the keystrokes must be yours. Refuse the keystrokes and the whole attack is a note lying unread under the door.

This scam’s grandfather called you on the phone (our 2017 story)

This page has an unusual claim to this topic: it first warned about the Win + R trick in January 2017, when the delivery vehicle was a phone call. The script back then: someone claiming to be "Windows Helpdesk" or "Microsoft Tech Support" would call — Microsoft never cold-calls anyone, then or now — and walk you through pressing Win + R, opening CMD, and typing assoc. Your own screen would fill with harmless file-type mappings, ending in a long string: ZFSendToTarget=CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}. "Read me that number," the caller would say, and then read it back to you perfectly. "That is your computer’s unique infected-license ID. See? We really are Microsoft." The trick: that identifier is identical on every Windows PC on Earth — it is just the ID of the "compressed folder" file association. It proved nothing except that the caller had a Windows machine too. From there came the remote-access request and the payment demand.

Compare the two eras and you see what actually evolved — and what didn’t. The 2017 version needed a human scammer on a phone line, live, one victim at a time, using your own screen as false proof. The 2026 version is a webpage that scales to millions and skips the proof stage entirely — a CAPTCHA needs no credibility, because we have all been trained to obey verification boxes without thinking, hundreds of times a year. What didn’t change: the keys. Win + R, then something pasted or typed, then Enter. The Run box has been the scam’s doorway for a decade because it is the shortest path from "instructions on a screen" to "code running on your machine." Which is why the family rule we suggested in 2017 still works verbatim today: nobody you did not call, and no website you did not build, gets to tell you what to press after Win + R.

How to spot a fake CAPTCHA in two seconds

One question sorts every real verification from every fake one: does it stay inside the browser? Real CAPTCHAs make you click pictures of traffic lights, type wobbly letters, or just tick a box while they watch how your mouse moves. Annoying, but entirely in-page. The moment a "verification" mentions your keyboard doing things outside the page — the Windows key, a Run box, a terminal, PowerShell, "copy this command" — it is an attack, full stop, no exceptions in either direction. There is no legitimate website on the internet that verifies humanity through your Run dialog, and there never will be, because the Run dialog proves nothing about being human. It only proves you can execute code.

The same recipe wears other costumes, so learn the shape, not the logo. The current wardrobe: a fake Cloudflare "checking your connection" page with steps; a fake Google Meet or Zoom error ("microphone permission failed — run this fix"); a fake browser update; a fake "this document failed to load, fix the error" box on a phishing email’s attachment; and a newer cousin the industry calls FileFix, which asks you to paste into the File Explorer address bar instead of the Run box — same trick, different doorway, because Explorer’s address bar also executes commands. Different stories, one recipe: the page gives you something to paste, and asks your hands to run it.

If one of these appears in front of you and you have not pasted anything, the exit is undramatic:

1. Take a screenshot if you can spare five seconds — useful for reporting, and for showing the family member you are about to warn.
2. Close the tab. Not the button on the fake page — the tab itself (or the whole browser if the page resists).
3. Overwrite your clipboard by copying any harmless text, so the staged command cannot be pasted later by accident.
4. Tell the site’s owner if it was a real site behaving strangely — there is a good chance they do not know they are hijacked — and move on with your day. Nothing ran. That is the system working.

What actually happens if you press Enter

Being specific beats being scary, so here is the typical sequence. The pasted one-liner fetches and runs an infostealer — malware whose entire business is copying, in under a minute, the valuables your browser keeps: saved passwords, active login cookies, autofill data (addresses, card numbers), and crypto-wallet files. Login cookies are the prize most people don’t know they own: with a stolen cookie, an attacker walks into your email or bank session already logged in, no password needed, sometimes sailing past two-factor prompts because the session was already trusted. Some campaigns instead plant a remote-access tool and sell the doorway later. Either way the machine usually looks completely normal afterward — no popups, no slowdown — because looking normal is the product. That is why the checklist below starts with accounts, not with the computer.

"I pasted it and pressed Enter" — do this now, in this order

First, breathe: this exact sequence fooled IT professionals, developers, and at least one security researcher who admitted it publicly. The design target of ClickFix is smart people on autopilot. What matters now is speed on the first three steps — stolen cookies and passwords get used or sold within hours.

1. Disconnect the machine from the internet (Wi-Fi off or cable out). This cuts off anything still exfiltrating and any remote-access session. Leave it off the network until step 5.
2. From a different device (your phone, on mobile data), change the passwords that matter, in this order: email first (it resets everything else), then banking, then anything with a card attached. Where you see "sign out of all sessions" or "sign out everywhere," press it — that invalidates stolen cookies, which a password change alone does not always do.
3. Turn on two-factor authentication on those same accounts if it wasn’t already, and treat any 2FA prompt you didn’t initiate as an attacker knocking — deny it.
4. Warn your bank if card numbers were saved in the browser’s autofill. A calm two-minute call now beats a dispute process later.
5. Now clean the machine: reconnect, update Microsoft Defender, and run a full scan (not quick) — Settings → Privacy & security → Windows Security → Virus & threat protection → Scan options. Follow with a second opinion from a reputable on-demand scanner if you want the reassurance.
6. Check what survives a reboot: Task Manager → Startup apps for anything unfamiliar, and taskschd.msc for scheduled tasks you didn’t create (infostealers often leave nothing behind, but remote-access tools persist).
7. If anything was found — or trust is gone — reset Windows (Settings → System → Recovery → Reset this PC, "Remove everything" for the clean-slate version). It is the nuclear option and also the honest one: a reinstall is certainty, and certainty sleeps better.
8. Watch statements for two weeks. Most misuse of stolen data happens fast; a card alert or an unfamiliar login email in week one is the pattern to catch.

And the step nobody puts on these lists: tell someone. Report it at reportfraud.ftc.gov (US), and mention it to the person in your life most likely to meet the same page tomorrow. Shame is this scam’s renewable fuel — every victim who stays quiet keeps the CAPTCHA looking trustworthy for the next person. You met a professionally engineered trap. Saying so out loud is a public service.

Why a CAPTCHA, of all things? (The psychology is the payload)

Because a CAPTCHA is the one interruption the internet has trained you never to question. You have completed hundreds of them; they are boring, they are legitimate, and they stand between you and the thing you actually wanted — so your brain files them as friction, not as content, and hands the task to autopilot. ClickFix parks its trap precisely in that blind spot: the steps feel like one more tedious hoop, and tedium switches off suspicion better than any disguise. There is a second, colder reason: the CAPTCHA framing pre-explains the weirdness. Asked cold to open PowerShell, most people hesitate. Told it is a "verification step," the same people comply, because verification rituals are expected to be arbitrary. The fix is not to become paranoid about every checkbox — it is one calm habit: the instant any verification mentions your keyboard leaving the browser, wake the autopilot up. That single reflex, taught to yourself and one other person this week, is worth more than any software on this page.

For IT admins: blunting ClickFix across a fleet

User training is the headline defense — the browser-boundary rule above makes a genuinely effective two-minute security briefing — but policy can remove most of the blast radius. The highest-value moves: block or restrict mshta.exe (Attack Surface Reduction rules, AppLocker, or WDAC — almost nothing legitimate still needs it); enable the ASR rule blocking obfuscated/downloaded script execution and PowerShell Constrained Language Mode for standard users; and for the frontline staff who will never need it, remove the doorway entirely — the GPO User Configuration → Administrative Templates → Start Menu and Taskbar → Remove Run menu disables Win + R (test on a pilot group; developers will riot, receptionists will never notice). Pair with PowerShell script-block logging and an alert on explorer.exe spawning powershell.exe/mshta.exe with network flags (the single highest-value ClickFix detection rule) — the execution chain is loud in logs precisely because it is quiet on screen. And put one line in the next all-hands note: "No website will ever ask you to press Windows + R. If one does, screenshot it and send it to IT — we pay in coffee." Bounties beat blame; you want to hear about the attempts.

How big this actually is (the numbers, sourced)

Scam warnings love vague superlatives, so here are actual figures with actual owners. Security researchers tracked ClickFix activity growing roughly 517% in the first half of 2025 alone. By Microsoft’s tracking — reported in January 2026 — the technique featured in about 47% of the initial-access attempts they observe, making it the single most common way attackers currently get a first foothold. In May 2026, Malwarebytes documented over 700 legitimate education and technology websites compromised to serve the fake-CAPTCHA version — which is why "only visit trusted sites" is no longer a defense; Jake’s parts supplier was a trusted site. And CAPTCHA-gated phishing volume hit 11.9 million attacks in March 2026 in one vendor’s telemetry — more than double the prior month. The trend line matters more than any single figure: this technique went from a curiosity to the industry’s number-one door in about eighteen months, precisely because it walks through the human, not the software.

FAQ — ClickFix and the Win + R scam, answered straight

What is the ClickFix scam?

A social-engineering attack where a fake verification page — usually a CAPTCHA — silently copies a malicious command to your clipboard and instructs you to press Win + R, Ctrl + V, and Enter, so you execute the malware yourself. Because you run it by hand, browser download warnings never trigger.

Is a CAPTCHA asking me to press Windows + R ever legitimate?

Never. Real verification lives entirely inside the browser — clicks, image picks, typed characters. Any "verification step" involving the Run box, PowerShell, a terminal, or pasting a command is an attack, with no exceptions.

I saw the fake CAPTCHA but didn’t paste anything. Am I infected?

No. The page can write to your clipboard, but it cannot press keys for you — that is exactly why it needs to trick you. Close the tab, and paste something harmless (any copied text) to overwrite the clipboard. Nothing ran.

I pressed Enter. What do I do first?

Disconnect the machine from the internet, then from a different device change your email password first, then banking, using "sign out of all sessions" wherever offered — stolen login cookies can outlive a password change. Then run a full Defender scan and work the checklist above.

Will Windows Defender catch ClickFix malware?

Often, but not reliably at the moment of execution — the whole design exists to look like a person legitimately running a built-in tool. Defender catches many payloads on disk or in memory afterward, which is why the full scan matters, and why not pasting in the first place beats every scanner.

What does the pasted command actually do?

Typically it tells PowerShell or mshta — legitimate Windows tools — to download and run malware, most often an infostealer that copies saved passwords, session cookies, autofill card data, and crypto-wallet files within a minute or two, then removes itself.

What is mshta, and should it even run?

A leftover Windows utility that executes HTML applications — nearly nothing legitimate uses it anymore, which is why attackers love it and why IT departments increasingly block it outright. If you ever see mshta in a command a website gave you, that alone is a verdict.

Can Mac or phone users get hit by ClickFix?

Macs, yes — the same pages detect macOS and serve Terminal commands instead of Win + R steps. Phones are largely immune to this specific trick because there is no equivalent "paste and execute" doorway in normal use, though the same fake pages may push phishing forms at mobile visitors.

Why did a legitimate website show me this?

Hijacking. Attackers compromise real sites — over 700 education and technology sites were documented serving fake CAPTCHAs in one May 2026 report — or buy malicious ads that redirect. The site’s reputation is the camouflage; report it to the site owner if you can.

What is the FileFix variant?

The same trick aimed at File Explorer’s address bar instead of the Run box — the page asks you to paste a "file path" there, and the address bar executes it as a command. Same rule applies: nothing a website gives you gets pasted into anything outside the browser.

What was the old Windows + R CLSID phone scam?

The 2017-era ancestor: fake "Microsoft support" callers had you run assoc in CMD and read back the ZFSendToTarget CLSID — a value identical on every Windows PC — claiming it was your unique infected-machine ID, as fake proof they were Microsoft. Same keys, same psychology, now automated by a webpage.

Does Microsoft ever call, email, or pop up asking me to run commands?

No. Microsoft does not cold-call, and no legitimate Microsoft page instructs you to paste commands into Run or PowerShell to "verify" or "fix" anything. That claim, from any channel, identifies the scam by itself.

Will resetting my PC remove ClickFix malware?

A full reset with "Remove everything" clears effectively all of it and is the certainty option. But reset alone does not un-steal what was already taken — do the password, session-signout, and bank steps regardless.

Is it safe to press Windows + R at all?

Completely — the Run box is a normal tool, and this site’s own guides use it constantly. The danger is never the keys; it is running content someone else supplied. Your own typed cmd is fine; a stranger’s pasted one-liner is not.

How do I protect a parent or a less technical family member?

Teach the one rule as a slogan — "no website ever needs your Windows key" — and make yourself the free hotline: "if any page or caller wants you to press keys, call me first, I will never be annoyed." A standard (non-administrator) Windows account for daily use also blunts what a pasted command can do.

Where do I report a ClickFix page or a tech-support scam?

In the US: reportfraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org. Microsoft takes tech-support-scam reports at microsoft.com/reportascam. If money moved, your bank first, then local police — a report number helps disputes.

Where to go next

Revision note. This page began life in January 2017 warning about the phone-call version of the Win + R trick, and was rewritten August 31, 2026, for the ClickFix era — the original’s CLSID story is preserved above because the history is the lesson. Figures are attributed where they appear: the ~47% initial-access share is Microsoft’s tracking as reported in January 2026, the 700+ hijacked sites are Malwarebytes’ May 2026 count, the 517% H1-2025 growth and the 11.9M March 2026 volume are security-vendor telemetry; all will drift as the campaigns do, and this page gets updated when the technique mutates again — it has before. If you landed here mid-panic with a command already run: the checklist above is judgment-free and ordered by what actually matters. This scam’s entire engine is borrowed trust and a moment of autopilot — it says nothing about your intelligence, and everything about theirs. Teach one person the browser-boundary rule this week and the page has done its job twice.