# ClickFix went mainstream, and it works

> A fake CAPTCHA and one pasted terminal command is now the most popular way to get malware onto a computer.
- Title: ClickFix went mainstream, and it works · Ars Technica
- Summary: A fake CAPTCHA and one pasted terminal command is now the most popular way to get malware onto a computer. If a website ever tells you to copy a line of text…
- Keywords: clickfix, malware, security, social engineering, macos, technology, science, went, mainstream, works, Ars Technica
- Source: Ars Technica — https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral
- Published: 2026-09-11T11:30:58+00:00
- Read time: 1 min
- Topics: clickfix, malware, security, social engineering, macos, technology, science
## From exotic to everywhere
ClickFix needs only a hacked website, a fake CAPTCHA overlay, and one terminal command. It works so well that nearly every malware crew now uses it, including Kremlin-backed groups.

> Legit websites everywhere [are] getting hacked to serve the fake captcha prompts.
## Stop blaming the victims
Experienced users write off the people who fall for it. But casual users have been trained by broken interstitials, endless CAPTCHAs, and shifting interfaces to just do the ridiculous thing.
## How the trick runs
A CAPTCHA box, often faked to look like Cloudflare's, appears. Engage with it and you get a line of obscured text plus instructions to paste it into Windows Run, PowerShell, or the Mac terminal.
## It comes from sites you trust
The prompts show up on websites people have used for years, and the steps look like a decade of normal computer chores. Without security training, there is no reason to pause.

> Why would someone without a firm grasp of computer security have any reason to hesitate?
## You are the signing certificate
Attackers used to need malvertised download portals, trusted Microsoft signing certs, and rotating domains. Since late May 2026, your own voluntary keystroke replaces all of it.

> The pivot to ClickFix in late May 2026 eliminates the code-signing requirement entirely.
## Macs are not safe either
Jamf and an independent researcher have documented macOS versions that get around Gatekeeper. Attackers also hide command infrastructure in public Google Sheets and blockchain smart contracts.
## What actually helps
BlockBlock can stop a ClickFix attack the moment you hit Command+V, and uBlock added similar protection. Beyond tools, warn the less technical people around you.

> Victim-blaming or shaming only makes the problem worse.
## Key takeaway

If a website ever tells you to copy a line of text and paste it into Run, PowerShell, or Terminal, close the tab. No legitimate site asks for that.