The ClickFix Scam

Everyone has clicked a CAPTCHA box. It is one of the most familiar parts of the internet. You see a grid of traffic lights or bicycles, you tap a few squares, and you move on with your day. It is muscle memory.

Cybercriminals know that. They know how automatic this moment has become. And they have created a new scam that uses that reflex against you. It is called the ClickFix scam, and it flips the entire idea of hacking on its head. Instead of breaking into your system, the attacker convinces you to unlock the door yourself.

This is how the scam works, why antivirus tools often miss it, and the single red flag that will protect you every time.

The scam begins when you land on a compromised website or click a suspicious link. A familiar verification box appears. It looks like a normal CAPTCHA. But instead of functioning correctly, the page suddenly displays an error message claiming the verification system failed.

A button appears with wording like Fix It or How to Fix.

When you click it, nothing obvious happens. But behind the scenes, the website quietly copies malicious code into your computer’s temporary clipboard. This is the invisible space your device uses when you copy text.

Once the code is sitting in your clipboard, the pop‑up gives you a list of keyboard shortcuts to type. This is where the real danger begins.

The instructions look official. They look like something a support technician might tell you. But they are designed to make you run the attacker’s code yourself.

Step One. Opening the system command window On Windows, the scam tells you to press Win plus R to open the Run box. On a Mac, it tells you to press Command plus Space and type Terminal.

Step Two. Pasting the hidden code The scam tells you to press Ctrl plus V on Windows or Command plus V on Mac. This pastes the malicious code directly into your system’s command window.

Step Three. Executing the program The scam tells you to press Enter. The moment you do, your computer runs the code. It downloads malware that can steal saved passwords, browser cookies, and cryptocurrency wallets.

Here is the scary part. Because you opened the command window and pressed the keys yourself, your antivirus software often assumes the action is intentional. It does not trigger the usual intrusion alerts.

A real CAPTCHA will never ask you to fix an error, open a system window, paste code, or use keyboard shortcuts.

Human verification checks always stay inside your web browser. They never require manual system actions.

If a website ever tells you that your computer needs a keyboard fix to display the page, close the tab immediately. You have just spotted a scammer.

Disconnect from the internet Turn off Wi‑Fi or unplug your network cable. This stops the malware from sending your information to the attacker.

Change your passwords Use a clean device such as your smartphone to update passwords for email, banking, and password managers.

Run a full system scan While still offline, open your trusted antivirus software and run a complete scan. If you do not have one installed, take the computer to a local professional who can remove hidden malicious files.

The ClickFix scam works because it tricks people into running malicious code themselves. Antivirus tools often miss it because the user appears to be performing a normal action.

Proactive IT’s cybersecurity approach is built for threats exactly like this. Our monitoring tools detect unusual command activity, clipboard behavior, and suspicious outbound connections. Our team trains employees to recognize social engineering tricks before they become a problem. And our zero‑trust security model limits the damage even if someone accidentally runs harmful code.

If your business wants protection that goes beyond basic antivirus, Proactive IT provides the proactive monitoring, training, and response systems that keep modern companies safe.

The ClickFix scam works because it feels familiar. It looks like a normal CAPTCHA error and uses instructions that seem harmless. But once you know the red flag, it becomes incredibly easy to avoid.

If a website ever asks you to fix a CAPTCHA by opening a system window or pasting code, close the tab. No legitimate site will ever ask you to do that.

Proactive IT will continue monitoring emerging threats like this and sharing clear, actionable guidance to keep your business safe.