ClickFix Attacks Are Spreading Across PCs and Macs: How the Scam Works and How to Avoid It

ClickFix attacks have moved from a relatively unfamiliar trick to a widely used method for delivering malware. The technique is simple: attackers compromise a legitimate website, place a convincing fake CAPTCHA or security prompt on top of it, and persuade visitors to copy and run a command on their own computer.

The method works on both Windows PCs and Macs. It succeeds not because the command necessarily looks sophisticated, but because the victim is guided into executing it voluntarily.

An article published on September 11, 2026, described the technique as increasingly common across compromised websites and malware campaigns, including activity linked to Kremlin-backed hacking groups. That does not mean every CAPTCHA or verification prompt is malicious. It does mean that an instruction to open Windows Run, PowerShell, or macOS Terminal and paste text should be treated as a serious warning sign.

What is a ClickFix attack?

ClickFix is a social-engineering technique that disguises a malicious instruction as a routine fix for a website problem.

A typical attack follows this sequence:

1. A legitimate website is compromised or modified.
2. Visitors encounter a fake CAPTCHA or security verification screen.
3. The page tells them to copy a line of text.
4. The instructions direct them to paste that text into a system utility.
5. The victim presses Enter or otherwise runs the command.
6. The command can begin installing or downloading malware.

The attacker is not exploiting the CAPTCHA itself. The CAPTCHA is a prop designed to create trust. The real attack begins when the user follows instructions to run content outside the browser.

Why the fake CAPTCHA is persuasive

The overlay often resembles a familiar service, including CAPTCHA designs associated with major internet infrastructure providers. Visitors may assume that the prompt is part of the website’s normal security process, particularly when it appears on a site they have used before.

The instructions can also seem plausible because users are accustomed to dealing with:

• Repeated CAPTCHA challenges
• Pop-up notices
• Anti-bot checks
• Pages that require unusual steps to continue
• Interfaces that change frequently

That environment has trained people to tolerate increasingly awkward instructions. A user who would never knowingly install malware may still copy and paste a command if the page frames it as a way to complete a verification check.

This is why blaming victims misses part of the problem. The attack takes advantage of security fatigue: the accumulated frustration and desensitization caused by burdensome online experiences.

What ClickFix asks users to do

The exact wording varies, but the core request is usually the same: move a command from the web page into a system-level tool and run it.

On Windows, the instructions may refer to:

• The Run dialog
• PowerShell

On macOS, they may direct the user to:

• Terminal

A legitimate CAPTCHA should be completed within the browser. It should not require a visitor to open a terminal, paste an unknown command, or execute text supplied by a web page.

That distinction is more useful than trying to recognize every visual variation of the scam. Attackers can change the logo, wording, colors, and layout. The request to run an unfamiliar command is the recurring danger.

Why the technique has become so widespread

ClickFix is attractive to attackers because it shifts much of the work onto the victim.

Instead of relying solely on a software vulnerability, the attacker persuades the user to initiate the command. The approach can be adapted to different operating systems and malware campaigns. It also requires only a compromised website, a deceptive overlay, and instructions that many users will follow without inspecting closely.

The technique has reportedly spread far beyond isolated incidents. Independent researcher Kevin Beaumont described seeing repeated reports on Reddit from people whose computers were infected after following ClickFix-style prompts. He also observed that legitimate websites were being compromised to display fake CAPTCHA pages.

The source material does not establish how many sites or users have been affected. It does, however, describe a pattern in which the technique is being adopted broadly by malware distributors rather than remaining an unusual or specialized tactic.

Warning signs to look for

Treat a page as suspicious if it does any of the following:

• Tells you to press a keyboard shortcut to open Run, PowerShell, or Terminal
• Asks you to copy text that is hidden, blurred, or difficult to inspect
• Instructs you to paste a command and press Enter
• Claims that a CAPTCHA requires action outside the browser
• Presents a CAPTCHA on a page where no such verification would normally be needed
• Gives unusual instructions for completing a routine verification

A particularly strong warning sign is a combination of a fake CAPTCHA and a request to paste text into a system utility. Do not follow the instructions merely because the page uses familiar branding or appears on a reputable website.

What to do if you encounter one

If a page asks you to run a command:

1. Do not copy or execute it.
2. Close the tab or browser window.
3. Avoid returning to the page to “try again.”
4. If the website is one you trust, report the suspicious prompt to its operator through a separate, known contact method.
5. If the device is managed by an employer or school, notify the relevant IT or security team.

Do not paste the command into a search engine in an attempt to identify it. Searching can sometimes provide context, but it does not make executing the command safe, and handling suspicious text can create additional opportunities for mistakes.

What to do after running a suspicious command

If you followed a ClickFix prompt, treat the computer as potentially compromised even if nothing obvious happened.

Immediate steps include:

• Stop using the device for sensitive activity.
• Disconnect it from the network if doing so will not interfere with an organization’s incident-response process.
• Contact your employer’s IT or security team if the device is managed by an organization.
• Run security checks using trusted, up-to-date tools.
• From a separate, trusted device, change passwords that may have been exposed.
• Review accounts for unfamiliar sign-ins, messages, or changes.
• Seek professional assistance if the computer contains sensitive personal, business, or financial information.

Changing passwords on the potentially infected computer may not be sufficient if malicious software is monitoring activity. A clean device is the safer choice for account recovery.

The appropriate response can depend on what command was run, what access the user had, and whether the computer belongs to an organization. A business device should be reported promptly rather than quietly repaired by the user.

How organizations can reduce the risk

Technical controls can help, but ClickFix is built around a human decision. Training should therefore focus on the specific behavior attackers want to provoke.

Useful guidance for employees and family members is straightforward:

• CAPTCHAs stay in the browser.
• Websites should not require visitors to run commands in PowerShell or Terminal.
• Never paste unknown text into a system utility because a web page requests it.
• If a page seems broken, close it and reach the service through a known bookmark or manually entered address.
• Report unusual prompts instead of trying to work around them.

Organizations can reinforce this guidance by limiting unnecessary administrative privileges, monitoring unusual command execution, and ensuring that employees know how to report a suspected compromise. Those measures may reduce the consequences of a successful deception, although they do not eliminate the underlying social-engineering risk.

The broader lesson

ClickFix attacks exploit a gap between technical security advice and ordinary internet behavior. Security professionals may recognize that no genuine CAPTCHA needs a user to execute a terminal command. Casual users, however, see a familiar-looking prompt on a familiar-looking site and may interpret the unusual step as another nuisance imposed by the modern web.

The most useful rule is simple:

Never run a command supplied by a web page just to pass a CAPTCHA or prove that you are human.

That rule remains effective even when the page is on a legitimate site, the prompt uses familiar branding, or the instructions claim to fix a browser problem. The website may have been compromised, and the command may be designed to turn the visitor into the person who launches the infection.

Sources

• Ars Technica, “ClickFix attacks infecting PCs and Macs are going viral,” published September 11, 2026: https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/