How to Protect Your Device from ClickFix Attacks

ClickFix attacks surged over 500% between 2024 and 2025, making this social engineering technique one of the fastest-growing online threats. Ars Technica reported in September 2026 that compromised websites displaying fake CAPTCHA pages are now mainstream, with attackers needing only a hijacked site and a convincing prompt to trick users into pasting malicious commands directly into their terminal. The technique works because it turns the user into the attacker's own tool, bypassing conventional security software that watches for malicious downloads but not for self-executed commands.

What Is a ClickFix Attack?

A ClickFix attack begins when you visit a compromised website or click a malicious advertisement. Instead of a normal.

CAPTCHA, you see a fake verification page that looks like Cloudflare's challenge interface. The page doesn't ask you to identify traffic lights or crosswalks. It tells you to copy a piece of text, open your terminal or PowerShell, paste the text, and press Enter.

The pasted text is a malicious command. Once executed, it downloads malware that steals passwords, browser cookies, and cryptocurrency wallet data. Microsoft Threat Intelligence has observed these campaigns targeting thousands of enterprise and end-user devices globally every day since early 2024.

The attack works on Windows, macOS, and Linux. Security researchers at Jamf documented macOS variants that bypass Apple's Terminal protections by using the built-in Script Editor instead. BlueVoyant tracked a threat group called "Lorem Ipsum" that dropped code signing entirely in favor of ClickFix, eliminating the need for signed installer packages.

Step 1: Recognize the Warning Signs

ClickFix attacks rely on one core deception: making you believe a legitimate website needs you to run a command. Learn to spot the red flags.

1. Check what the CAPTCHA asks you to do. A real CAPTCHA never tells you to open Terminal, PowerShell, or the Run dialog. If a verification page instructs you to press Windows Key + R, open a command prompt, or paste code anywhere, it's malicious.

2. Look at the page design. Attackers copy Cloudflare's visual style, but the instructions give them away. Cloudflare's real verification never requires copying and pasting commands.

3. Check the URL. Fake CAPTCHA pages often live on slightly modified domains that look legitimate at a glance.

Step 2: Harden Your Device Configuration

You can reduce your attack surface by changing how your device handles pasted commands.

1. On Windows, disable the Run dialog if you don't use it regularly. Open Group Policy Editor, navigate to User Configuration > Administrative Templates > Start Menu and Taskbar, and enable "Remove Run menu from Start Menu."

2. On macOS, restrict Script Editor access. Go to System Settings > Privacy & Security > App Management and remove Script Editor from the allowed list if you don't use it.

3. Configure your browser to block JavaScript from untrusted sites. Extensions like uBlock Origin or NoScript prevent the fake CAPTCHA page from loading or copying malicious text to your clipboard.

Step 3: Verify Before You Paste

The simplest defense costs nothing and takes two seconds.

1. If a website tells you to copy and paste something, read the text before pasting it. Malicious commands often contain recognizable patterns: "powershell", "curl", "wget", "Invoke-WebRequest", or base64-encoded strings.

2. If you see any of these patterns, close the page immediately. No legitimate verification system requires you to execute code.

3. Paste into a text editor first (Notepad on Windows, TextEdit on macOS) to inspect what's actually in your clipboard. Some attacks use JavaScript to copy malicious content to your clipboard without showing it on screen.

Step 4: Use Browser Security Extensions

Browser extensions add a layer of protection against compromised websites that serve fake CAPTCHA pages.

1. Install uBlock Origin. It blocks known malicious domains and filters out malvertising that leads to ClickFix pages.

2. Consider HTTPS Everywhere or a similar extension that forces encrypted connections, reducing the chance of man-in-the-middle attacks that inject fake CAPTCHA pages into legitimate websites.

3. Enable your browser's built-in phishing protection. Chrome, Firefox, and Edge all have settings that warn you before visiting known malicious sites.

Step 5: Educate Your Team or Family

ClickFix exploits the gap between technical users and everyone else. People who struggle with normal CAPTCHA challenges have learned to follow instructions without questioning them, and attackers know this.

1. Share the one rule that stops ClickFix: no real verification asks you to open a terminal. That single sentence prevents the attack.

2. Create a reporting channel. Whether it's a Slack channel, a family group chat, or an IT ticket system, give people a quick way to ask "is this real?" before they act.

3. Run a mock ClickFix exercise. Send your team a harmless test page that mimics a ClickFix prompt and see who falls for it. Microsoft offers simulation tools through Defender XDR that include ClickFix scenarios.

Common ClickFix Variants to Watch For

Attackers constantly update their lures. Here's what's circulating now:

Fake Google Meeting pages: Emails contain links to fake Google Meet URLs (meet.google.us-join.com instead of meet.google.com). The page shows a "connection error" and prompts you to "Try Fix," which triggers the clipboard attack.
HBO Max Reddit ads: Attackers hijacked Reddit accounts authorized to run HBO Max advertisements and posted hundreds of malicious ClickFix links disguised as sponsored posts.
Steam forum posts: Kaspersky reported in August 2026 that attackers disguise themselves as helpful commenters in Steam forums, tricking gamers into installing crypto miners.
ErrTraffic tool: A new crime tool automates ClickFix attacks by injecting fake "website errors" (garbled text, missing font warnings) into compromised sites, claiming up to 60% conversion rates.

Troubleshooting: What If You Already Clicked?

If you pasted and ran a suspicious command, act fast.

1. Disconnect from the internet immediately. Turn off Wi-Fi or unplug your Ethernet cable. This stops any ongoing data exfiltration.

2. Run a full system scan with Windows Defender, Malwarebytes, or your preferred antivirus. ClickFix payloads commonly include Lumma Stealer, Atomic Stealer (macOS), or similar infostealers that antivirus can detect.

3. Change passwords from a different device. Assume any credentials stored in your browser are compromised. Use a phone or another computer to change passwords for banking, email, and cryptocurrency accounts.

4. Check for unauthorized access. Review login history on your Google, Microsoft, and banking accounts for sessions you don't recognize.

5. Revoke browser cookies. In Chrome, go to Settings > Privacy and security > Cookies and clear all data. This invalidates any stolen session tokens.

The fundamental rule is simple: no legitimate website will ever ask you to open a terminal, PowerShell, or command prompt and paste code. If you encounter such a prompt, close the tab. That one habit stops ClickFix attacks regardless of how sophisticated the lure becomes.

To further protect your Android device from malware, try Bitdefender Mobile Security, which provides security protection for your phone.