ClickFix: Fake CAPTCHAs That Tell Visitors to Paste a Command

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

A visitor tells you your site asked them to prove they are human by pressing a keyboard shortcut and pasting something into a box on their own computer. That is not a CAPTCHA. It is a technique for getting people to run malware on themselves, and it works alarmingly well because it is dressed up as a familiar, boring security step nobody thinks twice about.

What the attack looks like

The visitor sees an overlay styled as a verification challenge — often imitating a well-known CAPTCHA widget, sometimes framed as fixing a display error or completing a browser check. Instead of clicking a checkbox, they are given instructions: press a key combination to open the Run dialog or a terminal, paste what has been copied to their clipboard, and press enter.

The clipboard was populated by the page itself, silently, when they clicked. What they paste is a command that downloads and runs a payload. The whole interaction feels like a technical formality, and the victim performs every step themselves, which is precisely why it bypasses the protections that would stop a drive-by download.

Why it is so effective

It defeats the defences people rely on. There is no malicious file download for the browser to warn about, because the download happens inside a command the user runs. There is no executable to be blocked, no security prompt to dismiss, and often no antivirus interception at the browser layer. The user is the delivery mechanism.

It also exploits habit. People have been trained by years of genuine CAPTCHAs to complete a small verification step without reading it carefully. Adding technical-sounding instructions makes it feel more legitimate rather than less, particularly to someone who assumes a site they trust would not ask them to do anything harmful.

Why it is on your site

Because your site was compromised and is being used to reach an audience. The overlay is delivered by injected JavaScript, exactly like a fake browser update, and the same campaigns often run both. Your domain provides the credibility that makes someone follow the instructions.

As with any injection of this type, it will usually be conditional — skipping logged-in users, skipping repeat visitors, sometimes targeting specific platforms — which is why you may never see it yourself no matter how many times you load the page.

What to do immediately

Take the site down or into maintenance mode while you clean it. This is one of the cases where I actively recommend downtime, because unlike spam injection there is a live victim at the end of every page view, and the payload runs on their machine with their privileges.

Preserve your logs before anything else — you need to establish when this started, because that determines your exposure window and what you tell people. Then find and remove the injection: my guide on injected JavaScript covers tracing it back through theme files, the database and plugin settings, and first steps after a hack covers the order of operations.

The full cleanup

Replace core, plugins and theme from clean sources, clean the database of injected content, delete administrator accounts you did not create, rotate every credential including database and hosting, and hunt for persistence in scheduled tasks and must-use plugins. Then close the entry route, or you will be doing this again shortly.

Verify from outside afterwards, in a private window, on a different network, arriving from a search result rather than typing your address. A conditional injection can easily stay quiet through a casual check.

Telling your visitors

Anyone who followed those instructions is now running malware, frequently an information stealer that harvests browser passwords and session tokens. They have no idea where it came from and no reason to connect it to your site. Telling them is the only way they find out.

Publish a short, factual notice: what the fake prompt looked like, the dates it was live, and clear advice — run a full malware scan, change passwords from a different device, and watch financial accounts. My guide on telling customers after a hack covers how to write it without either minimizing or catastrophizing. If you want the technical side handled quickly while you deal with the communication, that is what my malware removal service is for.

Common questions

Is this a real CAPTCHA that has been tampered with?

No. Genuine CAPTCHAs never ask you to open a Run dialog, a terminal, or paste anything into your operating system. Any verification step that involves keyboard shortcuts outside the browser is fraudulent by definition, regardless of how closely it imitates a familiar widget.

What happens to someone who follows the instructions?

They run a command that downloads and executes a payload, commonly an information stealer that collects saved browser passwords, cookies and session tokens. Because the user ran it themselves, browser download protections and many endpoint controls never get the chance to intervene.

Why has my antivirus not stopped this?

Because from the browser's point of view nothing malicious was downloaded. The page copies text to the clipboard and displays instructions; the actual download happens inside a command the user executes on their own system. That path avoids most of the checks that catch ordinary drive-by downloads.

I cannot reproduce it on my own site. Does that mean it is gone?

Not at all. These injections are conditional — they commonly skip logged-in users and repeat visitors, and may target particular platforms or traffic sources. Test in a private window, from a different network, arriving via a search result, before drawing any conclusion from not seeing it.

Do I have to tell my visitors about this?

You should. Anyone who completed the steps has active malware and no way to trace it back to your site. Whether a formal disclosure obligation applies depends on your jurisdiction and the data involved, but the practical and ethical answer is a prompt, plainly worded notice.