Glossary
What is ClickFix? Fake CAPTCHA social engineering explained
A social-engineering technique in which a fake CAPTCHA, browser check or error message tells the visitor to copy a command and run it themselves, so the victim installs the malware.
How a ClickFix lure works
Microsoft Threat Intelligence describes ClickFix as a technique that shows the visitor a fake CAPTCHA, human-verification prompt or error message, then gives them instructions to copy a command and paste it into the Windows Run dialog, Windows Terminal or PowerShell. The lure page usually copies the command to the clipboard without telling the visitor. When the person runs it, they install the payload themselves, which helps the attack get past controls that look for automatic downloads.
Microsoft says it first saw ClickFix activity between March and June 2024. It reports lures delivered through phishing emails, malvertising and compromised websites, payloads that include the Lumma Stealer infostealer, and a macOS variant that asks users to run a command in Terminal.
Warning signs to teach
- A website or "verification" step asks you to press keys such as Windows + R, paste something and press Enter.
- Something you did not knowingly copy is already on your clipboard.
- A CAPTCHA asks for anything beyond clicking or picking images.
Microsoft's recommendations include educating users to recognise the technique and making sure they are aware of what they copy and paste.
Practising it safely
SecurityRing runs ClickFix as a live email simulation. The landing page shows a fake browser-verification panel with a harmless token and a simulated console that runs only inside the browser page. Nothing is ever executed on the employee's computer. The report records who copied the token and who completed the simulated run, and the employee goes straight to a short lesson.
Sources
- Microsoft Threat Intelligence, Think before you Click(Fix): Analyzing the ClickFix social engineering technique, 21 August 2025. Accessed 15 October 2026.