A fake CAPTCHA scam is a verification page that tells you to copy, paste, or run a command instead of proving you are human. This ClickFix attack turns an ordinary-looking prompt into a request for you to execute the attacker's instructions on your own Windows PC or Mac.

Key Takeaways

A normal CAPTCHA may ask you to select images, type characters, or tick a box; it does not ask you to open Run, PowerShell, or Terminal.

The safe mental model is lure page → clipboard → user execution → malicious payload.

Merely seeing the page is different from executing its instructions, so the response should match the exposure.

If you entered a password after running anything, secure that account from another trusted device.

For the wider habits that reduce phishing, malware, and account risk, start with the online security guide.

How does a fake CAPTCHA scam work?

The page borrows the appearance and language of a familiar anti-bot check. It may claim that verification failed, that a browser error needs fixing, or that one more action will prove you are not automated. The Australian Cyber Security Centre describes ClickFix activity that used fake CAPTCHA pages to persuade visitors to run commands, crossing the key boundary from viewing content to executing attacker-supplied instructions.［1］

The attack can be understood without reproducing any command:

Lure page: A compromised or deceptive page creates a believable reason to complete a check.
Clipboard: A button or scripted action places attacker-controlled text on the clipboard, sometimes while showing an innocent-looking message.
User execution: The victim is directed to open a system command interface and paste or approve the text.
Malicious payload: The executed instruction retrieves, launches, or enables unwanted software and may lead to credential or data theft.

Microsoft has documented ClickFix as a social-engineering technique used across Windows and macOS. The wording and delivery change, but the attacker still needs the person at the keyboard to bridge a security boundary.［2］ A polished page, padlock icon, or familiar CAPTCHA design does not make that requested action safe.

What makes a fake verification page suspicious?

Judge the requested action, not the graphic design. A genuine human-verification widget normally stays inside the browser tab. It may refresh, ask for another image, or fail gracefully, but it should not require a system shell, administrator approval, a download, or disabled security controls.

Prompt or behavior	Lower-risk verification behavior	Fake CAPTCHA warning sign
Human check	Select images, solve a puzzle, or tick a box in the page	Open a separate system utility
Clipboard	No command is silently prepared	Press a button that copies hidden text
System access	Browser tab remains the whole interaction	Open Run, PowerShell, Command Prompt, Terminal, or a script tool
Privileges	No administrator rights needed	Approve an administrator or security prompt
Download	Verification completes without installing anything	Download an archive, installer, profile, or update
Language	Clear retry or access-denied message	Urgent claim that the computer, browser, or account will be blocked

Proofpoint has tracked ClickFix across different lures rather than one fixed visual template.［3］ That is why memorizing a logo or one sentence is less useful than recognizing the command-execution request.

Why is a fake CAPTCHA command more dangerous than clicking the page?

A browser normally limits what a web page can do. The page can display content and request permitted browser actions, but it cannot freely make system changes. When it persuades you to paste text into a command interface, it tries to make your own user account perform actions the browser could not perform directly.

The copied text may be longer than the visible field, disguised by spacing, or replaced after you inspect it. You should not paste it into another utility “just to see what it does.” Do not forward the command to friends, place it in an online decoder, or run it in a work environment. Preserve the page address and a screenshot only if that can be done without repeating the requested action.

Windows and macOS use different tools and permission prompts, but the decision rule is the same: a website does not need a system command to establish that you are human. If a message also claims the device is infected, compare it with the signs of a fake virus alert and leave the page.

What should you do after a ClickFix attack prompt?

Use the highest exposure level that actually happened. If you are unsure whether a command ran, treat it as executed until you can verify otherwise.

Exposure	What it means	First response
You only saw the page	No instruction was copied, pasted, downloaded, or run	Close the tab; clear any site notification permission you granted; no device reset is indicated by the page alone
You clicked or copied text	The clipboard may contain attacker text, but you did not execute it	Do not paste it; replace the clipboard with harmless text; close the page; check whether a file was downloaded
You executed a command	The device may have retrieved or launched unwanted software	Disconnect it from the network, stop using it for sensitive accounts, and begin device investigation
You also entered credentials	The device and the account may both be compromised	From a separate trusted device, change the exposed password, revoke sessions, and check recovery settings before device cleanup

If you only viewed the page

Close it without using the page's own “cancel,” “fix,” or support buttons. If it opened from a message, preserve that message for reporting and then delete it. Check the browser's notification permissions if you allowed the site to send alerts, because later notifications can continue the deception.

Seeing the page alone is not evidence that malware installed itself. Scan only if another sign exists, such as an unexpected download, a security alert from trusted software, or continued abnormal behavior. Panic-driven resetting can destroy useful evidence and waste time without addressing the real exposure.

If you clicked or copied but did not execute

Do not paste the clipboard contents into Run, a shell, a chat, or a search box. Copy a harmless sentence to replace it, close the tab, and review the download list without opening new files. If the browser began a download, delete the untrusted file without launching it and use the operating system's normal security scan.

Clicking a page button can also grant a browser permission or start a redirect. Review new notification permissions, downloaded files, and tabs that opened. If the lure arrived by email or text, follow the broader phishing protection checklist.

If you executed the command

Disconnect the affected device from Wi-Fi or Ethernet. Do not use it to sign in to email, banking, a password manager, or work systems. Record the approximate time, page address, browser, actions you took, and any files or security alerts you noticed; do not rerun the instruction to recreate evidence.

Use trusted security software to perform a full scan and install legitimate operating-system updates. Review recent downloads, installed applications, browser extensions, login items, scheduled tasks, profiles, and unfamiliar user accounts. A clean scan lowers uncertainty but cannot prove that nothing was copied or that no credential was captured.

If the command had administrator approval, security tools were disabled, persistent unfamiliar software remains, or sensitive work data was available, seek qualified support. A carefully planned rebuild may be appropriate in a high-impact case, but it is not automatically the first step for every prompt.

If you entered passwords or payment details

Move account recovery to a different device that was not involved. Start with the primary email because it can reset other accounts, then protect financial, work, cloud, and social accounts. Change exposed or reused passwords, sign out other sessions, remove unknown recovery methods, and enable a phishing-resistant MFA option where the service supports one.

Contact the financial provider through a known number if payment data or a transaction was involved. Watch for new-device alerts, password resets, forwarding rules, unknown applications, and follow-up calls from people claiming to be investigators. The steps after clicking a phishing link help separate credential exposure from device exposure.

How can you prevent a malicious command from being trusted?

Pause whenever a website moves the task outside the browser. Read the full prompt before pressing a keyboard shortcut, and never treat a copied command as safer because the page says it was “verified.” If a service appears blocked, open its official site in a fresh tab or contact support through a channel you found independently.

Do not shame someone who followed the prompt. ClickFix is designed to exploit familiarity and urgency. A calm report made quickly gives an employer, school, or family member more time to isolate a device and protect accounts.

Summary

A fake CAPTCHA scam asks for a system action that genuine browser verification does not need.
The ClickFix chain depends on the clipboard and the user's execution of attacker-controlled text.
Response starts with the real exposure: viewed, copied, executed, or executed plus credentials.
Account recovery belongs on a trusted device; device investigation follows separately.
Remember the behavioral rule instead of a particular CAPTCHA logo or lure.

FAQ

Can a real CAPTCHA ask me to open PowerShell or Terminal?

No. A legitimate CAPTCHA has no reason to ask you to open Run, PowerShell, Command Prompt, Terminal, or another system command tool. Leave the page and verify the service through an independently opened official site.

Am I infected if I only saw a fake CAPTCHA?

Not necessarily. Merely viewing a page is a lower exposure than downloading or executing its instructions. Check for an unexpected download or permission change, but do not assume the page alone proves an infection.

What if I copied the command but never pasted it?

Replace the clipboard contents with harmless text and close the page. Review downloads and browser permissions, but the main execution boundary was not crossed if the text was never run.

Should I paste the text somewhere safe to inspect it?

No. Pasting attacker-controlled text into a shell, automation tool, online service, or shared workplace can create another exposure. Preserve the page address or a safe screenshot instead, and let a qualified responder inspect the case without executing it.

Does a browser security warning always appear?

No. The social-engineering page may be allowed to display normally, and the dangerous step happens when the user follows instructions outside the browser. Absence of a warning does not validate the requested action.

Should I change every password after executing a command?

Prioritize passwords entered, displayed, stored, or used on the affected device, beginning with primary email and financial accounts. Use a trusted device, revoke sessions, and examine recovery methods; changing passwords on a potentially controlled machine can expose the new ones.

Is a factory reset always required after ClickFix?

No. The decision depends on whether anything executed, what privileges it received, what the investigation finds, and how sensitive the device is. Administrator execution, persistent changes, or high-value work data can make a rebuild the safer option.

Can the same scam target a Mac?

Yes. The tool names and prompts differ, but Microsoft has described cross-platform ClickFix activity. The universal warning sign is a web page asking you to run a system command or approve unusual access.

Disclaimer: This article provides general cybersecurity education and is not a substitute for professional incident-response, legal, or financial advice.

Sources

Australian Cyber Security Centre — ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure — https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure
Microsoft Security Blog — Think before you ClickFix: Analyzing the ClickFix social engineering technique — https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
Proofpoint — Security Brief: ClickFix social engineering technique floods threat landscape — https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

Sources checked 28 August 2026.

Related articles:

What Is a Fake CAPTCHA Scam?