Most people have clicked a CAPTCHA box hundreds of times without thinking about it. Attackers know this, and they are using it. A technique often called ClickFix uses a fake "verify you are human" page to persuade the victim to run malicious commands on their own computer.

Because the user runs the command themselves, the attack can slip past defences that are designed to stop malicious downloads and attachments.

How a ClickFix attack works

  1. The lure. The user lands on a compromised website, a malicious advert or a link in an email. The page shows what looks like a normal CAPTCHA or an error message.
  2. The "verification steps". Instead of ticking a box, the page asks the user to press a short sequence of keys, typically opening the Windows Run box, pasting and pressing Enter. It looks like a quick technical check.
  3. The hidden command. Behind the scenes, the page has already copied a malicious command to the clipboard. When the user pastes and presses Enter, that command runs with their permissions.
  4. The payload. The command usually downloads information-stealing malware or a remote access tool, which can harvest saved passwords, browser sessions and files.

The rule to teach every member of staff: no genuine website will ever ask you to press keyboard shortcuts, open the Run box or paste anything into a command window to prove you are human.

Why it works

ClickFix works because it borrows trust from something familiar. The instructions are short, look official and arrive at a moment when the user just wants to get to the page. Nothing is "downloaded" in the usual sense, so it does not feel risky.

Five ways to protect your business

1. Tell your staff about it, specifically

General phishing training helps, but this attack is unusual enough that people need to see an example. A short message with a screenshot and the rule above is one of the most effective defences you have.

2. Restrict the Run box and script tools for standard users

Most staff never need the Run dialog, PowerShell or other command-line tools. Policies in Microsoft Intune or Group Policy can restrict them for standard users while keeping them available to IT.

3. Use endpoint detection and response

Modern endpoint detection and response (EDR) watches for suspicious behaviour, such as a command shell launching a download from an unusual site, and can stop it even when no known malware file is involved.

4. Make sure stolen passwords are not enough

The aim of many ClickFix campaigns is to steal credentials and sessions. Multi-factor authentication and conditional access rules in Microsoft 365 limit what an attacker can do with them.

5. Know what to do if someone has already done it

If a member of staff thinks they followed these steps, they should disconnect from the network and call IT straight away. Speed matters: the device needs isolating and checking, and the user's passwords and active sessions need resetting.

How Equasys can help

Our managed cyber security service combines endpoint detection and response, Microsoft 365 hardening, multi-factor authentication and practical phishing awareness, so attacks like this are far less likely to succeed. If you are worried a device has been affected, call us on 0333 996 5000.