Fake CAPTCHA Wants You to Paste a Command? Don't

By Muhammad Imran · Reviewed for accuracy against Google, Microsoft, Forescout, and MITRE guidance · Last updated October 2026.

You are reading an article, watching a video, or opening a document when the screen changes. A box pops up: verify you are human. Below it are three steps. Press two keys, paste, press Enter. It looks like a small chore, the kind of thing you have done a hundred times. It is not a chore. Those three steps are the whole attack.

This trick has a name: ClickFix. Security researchers named it that because the page tells you to "fix" something, and the fix is you running their program for them. It does not need a virus on your computer first. It does not need you to download anything. It needs only your hands on the keyboard, following instructions that look harmless. This guide shows how it works step by step, the disguises it wears, the new twist researchers found in October 2026, and the 10-second check that stops it.

How ClickFix works, step by step

1. The lure page. You land on a page that looks like a normal security check, an error message, or a repair notice. It may be a hacked real website, or a fake page built for this one job. Either way, the page is the trap.
2. The silent copy. The moment you click the checkbox or the "verify" button, the page quietly copies a command onto your clipboard. You do not see it. You do not choose it. Your computer now holds instructions written by a stranger.
3. The keys. The page tells you to press the Windows key and R together (on a Mac, open Terminal), then paste, then press Enter. On Windows, those two keys open the Run box, a small window that runs programs.
4. The paste. You paste and press Enter, believing you pasted a verification code or a fix. What you actually pasted is a command that starts a program.
5. The infection. That program connects to the scammers, downloads the real malware, and in many cases steals passwords saved in your browser. Nothing looked like a download. Nothing asked your permission. You did every step yourself, which is exactly why it works.

One detail matters: the command you paste is often not the command shown on the page. Google, announcing new Chrome protections on October 20, 2026, noted exactly that: the pasted text can differ from the displayed text. Reading the steps carefully cannot save you, because the steps lie about what they do.

Three disguises to recognize

Earlier versions mimicked a browser crash screen and a word processor message about a missing extension. Recent ones copy the look of Google reCAPTCHA and Cloudflare Turnstile. The brand on the box proves nothing. Any verification that needs your keyboard outside the browser is fake, whatever logo sits on it.

Why this trick works

• No download to catch. Your antivirus watches downloads. Here there is no download at the moment of the trick, only text on your clipboard. The download happens later, after you already ran the first command.
• You are the trusted user. Your computer trusts commands typed by its owner. A pasted command from your own clipboard looks like your own work.
• Trusted tools do the damage. Run, PowerShell, and Terminal are normal parts of Windows and Mac. The attack uses them instead of a suspicious program, so nothing looks out of place at first.
• Nothing to patch. There is no software flaw behind this. No update closes it, because the flaw is the instruction, not the code. The defense is a habit, not a download.
• It is everywhere. One security tracker, Ohey, counted 50,440 websites carrying ClickFix code since August 1, 2026, in a count published October 28, 2026. That is one tracker's count, not a total, but it shows the size: this is not one bad website. It is an industry.

The October 2026 twist: the file is already on your computer

In early October 2026, Microsoft Threat Intelligence described a version that removes the last visible warning sign. On a cluster of compromised websites, visitors saw a fake CAPTCHA-style check and were told to press Windows key + R, paste, and press Enter. But the bad file was not downloaded after they obeyed. It was already there.

While the page loaded, it quietly fetched a file disguised as a picture and stored it in the browser's cache, the storage browsers use to remember images so pages load faster. The pasted command did not download anything. It searched the browser's stored files by size, found the hidden file, copied it under a script name, and ran it. Later steps gathered information about the computer, fetched more code, and aimed at passwords stored in the browser. Microsoft's Defender software detects this chain as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.

Here is the sentence to remember: a real CAPTCHA keeps the check inside the browser. It never needs the Run box, PowerShell, or Terminal. If a check asks for any of those, it is not a check. Close the page.

It is no longer one fake page at a time

In October 2026, researchers at Forescout reported a discovery that shows how organized this business has become:

ClickFix is no longer just one fake page at a time. Researchers found a reusable backend called ROMULUS behind several lures, including one reached through a chatbot. The rule stays the same: a real verification step never asks you to leave the browser and paste a command into Run or PowerShell, and a familiar company or chatbot name does not make a paste instruction safe.

Forescout found the same ROMULUS login panel on six servers, with different lures feeding different malware, including a route that delivered the LegionLoader malware through a PowerShell script and nested encrypted archives. The researchers say they do not know who runs the panel. For you, the operator's name does not matter. What matters is the pattern: when the same backend serves many lures, the same rule defeats all of them. Never paste.

ClickFix is not a tech-support call

Both scams want control of your computer. The difference is the channel, and the channel decides your first move. Our tech-support guide covers the phone version in full.

The 10-second check

1. Stop at the keyboard step. Any page that tells you to open Run, PowerShell, or Terminal has failed the test, whatever else it shows.
2. Close the page. Use the X on the browser tab, or close the whole browser if the page fights you.
3. Do not paste. If you already copied something from that page, copy something harmless next, like a word from this guide, to push it off your clipboard.
4. Do not call any number on the page. A real verification page has no support number to call about verification.
5. Type addresses yourself. If you need the real site, type it yourself or use a bookmark you made. Never follow the page's own link to "the real site."

Turn on Chrome's extra protection

On October 20, 2026, Google announced new Chrome defenses against this exact trick. For people who turn on Enhanced Protection in Chrome's Safe Browsing settings, Chrome now watches for copied commands that look like ClickFix scripts. It scrubs personal information out of the copied text, checks the rest with Safe Browsing, and warns you before you paste if the verdict is dangerous.

To turn it on in Chrome: open Settings, then Privacy and security, then Security, then Safe Browsing, then choose Enhanced protection.

Know the limits. Enhanced Protection is off by default, so most people do not have it yet. It covers Chrome only, and only when it is on. It does not protect other browsers, and it does not protect you if you type the command by hand instead of pasting. Think of it as a seatbelt, not a wall. The habit in the 10-second check is still the main defense.

Mac users are not exempt: ClickFix pages also give Terminal instructions for Macs. Apple added a Terminal paste warning in macOS Tahoe 26.4, released in March 2026, which is one more chance to stop. The rule is identical on every computer: a verification step never needs Terminal.

If you already pasted

If you copied but did not paste: nothing ran. Close the page, copy something harmless to clear your clipboard, and carry on. You stopped in time.

If you pasted and pressed Enter, do these steps in order:

1. Disconnect from the internet. Turn off Wi-Fi, or unplug the network cable. This stops the program from sending anything more to the scammers while you clean up. Leave it disconnected until the scan is done.
2. Stop typing passwords. Do not log in to email, banking, or shopping on that computer until it is checked. If you already typed a password after pasting, plan to change it from a different, clean device.
3. Run a full scan. On Windows, open Windows Security and run a full scan with Microsoft Defender. Let it finish, and follow what it tells you to remove.
4. Change important passwords from a clean device. Email first, then banking, then shopping. Use a different device, or a phone, not the computer that ran the command.
5. Watch your statements. Check bank and credit card statements for charges you do not recognize, and check your Medicare statements line by line if you use Medicare.
6. Report it. Report to the FTC at ReportFraud.ftc.gov, and to the FBI's Internet Crime Complaint Center at ic3.gov. Reporting helps investigators track the pages, even when the money is already gone.
7. If it is a work computer, tell your IT team right away. They have tools to check the machine properly.

If nothing seemed to happen after you pasted, do not take that as safety. The whole point of the newer versions is silence. Follow the steps anyway.

Questions seniors ask

Sources: Microsoft Threat Intelligence, ClickFix campaign report (October 3, 2026); Google Blog, Our latest defenses against evolving web scams (October 20, 2026); Forescout Research, Vedere Labs, ROMULUS analysis (October 2026); MITRE ATT&CK, T1204.004 Malicious Copy and Paste; Ohey ClickFix tracker count (October 28, 2026). Last updated October 2026.

Related: ‘Microsoft Calling’? Tech Support Scams Seniors Should Know →

Related: Geek Squad Invoice Email? Don't Call That Number →

Related: Sent Money or Shared Payment Details? What to Do →