From exotic to everywhere

ClickFix needs only a hacked website, a fake CAPTCHA overlay, and one terminal command. It works so well that nearly every malware crew now uses it, including Kremlin-backed groups.

“Legit websites everywhere [are] getting hacked to serve the fake captcha prompts.”

Stop blaming the victims

Experienced users write off the people who fall for it. But casual users have been trained by broken interstitials, endless CAPTCHAs, and shifting interfaces to just do the ridiculous thing.

How the trick runs

A CAPTCHA box, often faked to look like Cloudflare's, appears. Engage with it and you get a line of obscured text plus instructions to paste it into Windows Run, PowerShell, or the Mac terminal.

It comes from sites you trust

The prompts show up on websites people have used for years, and the steps look like a decade of normal computer chores. Without security training, there is no reason to pause.

“Why would someone without a firm grasp of computer security have any reason to hesitate?”

You are the signing certificate

Attackers used to need malvertised download portals, trusted Microsoft signing certs, and rotating domains. Since late May 2026, your own voluntary keystroke replaces all of it.

“The pivot to ClickFix in late May 2026 eliminates the code-signing requirement entirely.”

Macs are not safe either

Jamf and an independent researcher have documented macOS versions that get around Gatekeeper. Attackers also hide command infrastructure in public Google Sheets and blockchain smart contracts.

What actually helps

BlockBlock can stop a ClickFix attack the moment you hit Command+V, and uBlock added similar protection. Beyond tools, warn the less technical people around you.

“Victim-blaming or shaming only makes the problem worse.”