In short: A fake CAPTCHA is not a verification check — it is the ClickFix attack. A compromised site copies a malicious command into your clipboard and then asks you to "confirm you're not a robot" by pressing Win+R, pasting the command, and hitting Enter. This launches an infostealer that steals passwords, session cookies, and crypto wallet data. A real CAPTCHA never leaves the browser window and never asks you to open a system dialog or a terminal. Simply seeing a fake CAPTCHA is harmless; the infection happens only if you execute the command. If a page asks you to press Win+R or open Terminal — close the tab immediately.
What a fake CAPTCHA is and how ClickFix works
A CAPTCHA is a familiar challenge: click traffic lights, type a code, check the "I'm not a robot" box. Most people complete it on autopilot. That automatic habit is exactly what ClickFix exploits.
ClickFix is a social-engineering technique where a compromised or purpose-built site displays a fake CAPTCHA interface. At that moment, malicious JavaScript has already silently copied a command into your clipboard — without your knowledge or consent. The page then explains "verification steps": press a keyboard shortcut, open a system window, paste from the clipboard, and press Enter. If you follow through, the command runs with your user privileges — as if you had typed it yourself. No OS exploit, no browser vulnerability — just your own actions.
In 2025–2026 ClickFix became one of the top three initial-access methods. Professional "ClickFix-as-a-service" panels have appeared that criminal groups rent like ordinary SaaS. Malwarebytes documented more than 700 educational and technology sites serving fake CAPTCHAs in May 2026 alone. Before a ClickFix page can do anything, it first has to get you there — learn how to spot a fake website before entering.
How the attack works step by step
The common logic: the site poisons your clipboard → displays a convincing "verification" UI → tells you exactly what to press. The next steps differ by platform.
On Windows
The most common variant. The page instructs you to press Win+R (opens the Run dialog), then Ctrl+V to paste the clipboard contents, then Enter. The command — typically a PowerShell one-liner or an mshta call — runs with your current user privileges and downloads or unpacks an infostealer. Windows UAC and most default antivirus configurations do not block this automatically: from the system's perspective, you typed the command yourself.
On macOS
The Mac variant was documented by Microsoft Security and Palo Alto Networks Unit 42 (May–June 2026). The page asks you to open Terminal and paste a command. The command downloads a DMG disk image and mounts it silently via the built-in hdiutil utility, then launches a malicious app bundle. The payload is AMOS (Atomic macOS Stealer): an infostealer targeting macOS Keychain, Safari, and crypto wallet extensions.
On Android and iPhone
Mobile operating systems do not expose a system shell to web pages, so the approach is fundamentally different. A ClickFix page on a phone does not ask you to paste a PowerShell command. Instead, it redirects you to a fake download page, a counterfeit app update, or prompts you to install a configuration profile. The principle is the same: you voluntarily take an action that looks routine but installs malware. The defence is also the same: never install apps or profiles at the request of an unsolicited web page.
What the infostealer actually steals
The end goal of ClickFix is to run an infostealer. The most prevalent families in 2025–2026 are Lumma Stealer and StealC (Windows) and AMOS (macOS). For a deeper look at this class of threat, see the guide on infostealer malware and credential theft.
Within minutes of launching, an infostealer collects:
- Session cookies and tokens — active browser sessions for all logged-in sites; the attacker imports them into their own browser and enters your account without a password, bypassing any two-factor check that already passed.
- Saved passwords from all browsers and any browser-based password manager.
- Autofill data — names, addresses, and card numbers stored in browser forms.
- Crypto wallet keys and seed phrases — MetaMask, Exodus, Trust Wallet, and similar extensions are targeted specifically.
- macOS Keychain (on Mac) — Safari credentials, saved Wi-Fi passwords, and app keys.
ClickFix does not "break" multi-factor authentication directly. But stolen session cookies already represent an authenticated session — no second factor is prompted. This is why cookie theft is more dangerous than a stolen password alone.
How to recognise a fake CAPTCHA — red flags
One rule covers everything: a real CAPTCHA never leaves the browser window. Anything that asks you to open a system utility, press an OS keyboard shortcut, or paste a command is fake.
| Criterion | Real CAPTCHA | Fake CAPTCHA (ClickFix) |
|---|---|---|
| Where it happens | Entirely inside the browser | Asks you to open an OS window or Terminal |
| What you must do | Click images, tick a box, type a code | Press Win+R, open Terminal, run a command |
| Clipboard use | Does not touch the clipboard | Silently copies a command into the clipboard |
| Privileges used | None beyond browser sandbox | Your full OS user privileges |
| What happens next | Page content loads | Prompts you to press Ctrl+V then Enter |
| Works without internet access | Browser-side logic, no extra request needed | Requires executing an external command |
Does a VPN protect against ClickFix? (honest answer)
No — and it is important to say so plainly. A VPN does not stop ClickFix. The attack works through your own actions: you copy and run the command yourself, with your own permissions, on your own machine. The infostealer starts locally before it sends anything over the network, and the VPN tunnel does not sit between you and the command prompt. For a clear account of where VPN protection actually begins and ends, see what a VPN protects against.
What a VPN genuinely provides in the context of broader hygiene: on a public network (café, airport, hotel) it encrypts your traffic and prevents the access-point owner from injecting fake pages or intercepting data in transit. This reduces the risk of landing on a spoofed site via DNS hijacking — but it does not protect against actions you take voluntarily. LiMP VPN secures the channel; what you type into a command prompt is up to you.
What to do: safety checklist
- Never paste commands from a "CAPTCHA". Any verification that asks for system-level actions is fake — close the tab.
- Do not press Win+R (or open Terminal) at a website's request. No legitimate verification service requires opening a system dialog.
- Periodically clear your clipboard, especially after visiting unfamiliar sites.
- Keep your OS and browser up to date. Patches close the side-channels that make scripts less detectable.
- Use two-factor authentication and a password manager — they won't stop ClickFix, but they limit the blast radius if an infostealer does run.
- Check the site address before entering any data. Most ClickFix attacks begin on compromised or lookalike domains.
- Use a VPN on public networks — encrypting the channel reduces DNS-hijack and page-injection risk, even though it does not block ClickFix directly. See LiMP VPN pricing for plan options.
What to do if you already ran the command
If you pasted but have not pressed Enter yet — do not press it. Close the Run dialog or Terminal, clear your clipboard, and shut the tab. You are safe. If the command already ran, act quickly:
- Disconnect from the internet (disable Wi-Fi or unplug the cable) — this cuts the infostealer's connection to its command server and may halt data exfiltration.
- Change passwords from a second, clean device that was not on the same page. Start with email and banking.
- Terminate all active sessions in email, messaging apps, and social networks — most services have a "sign out everywhere" button in security settings.
- Regenerate two-factor authentication for critical accounts — if the infostealer grabbed a TOTP secret key, your current codes may be compromised.
- Run a full antivirus scan on the infected machine (after changing passwords from a different device).
- For cryptocurrency — move funds to a wallet on a clean device as fast as possible: infostealers specifically hunt seed phrases and may have already copied them.
For a full incident-response checklist, see the guide on how to protect your account from hacking.
Frequently asked questions
Will my device get infected just from seeing a fake CAPTCHA?
No. Viewing the page — even if JavaScript copies something to your clipboard — does not execute any code. Infection only happens if you paste the clipboard contents into a system prompt and run it. If you did not press anything in the OS, close the tab, clear the clipboard, and carry on.
Do real CAPTCHAs ever ask you to press Win+R or open Terminal?
Never. Legitimate services — Google reCAPTCHA, hCaptcha, Cloudflare Turnstile — work entirely in the browser: click, tick, type. They never require actions in the OS, never ask you to open a command line, and never touch your clipboard. Any deviation from this is a red flag.
Will antivirus software catch a ClickFix attack?
Partly. A good antivirus may detect the infostealer after it downloads or flag a known malicious domain. But ClickFix frequently uses fresh, unrecognised payloads, and the launch itself happens through legitimate system tools (PowerShell, mshta) initiated by the user. Keep your antivirus updated — but treat it as one layer, not the only one.
Can a fake CAPTCHA infect an iPhone or Android?
The attack takes a different form on mobile: there is no system shell exposed to web pages. On a phone, ClickFix-style attacks redirect to fake download pages, counterfeit app updates, or prompt installation of a configuration profile. The same defence applies: never install apps or profiles at the request of a web page you did not intentionally visit.
What if I pasted the command but did not press Enter?
Nothing bad happened. Without executing the command, no infostealer runs. Close the Run dialog or Terminal window, clear your clipboard, and close the tab. No infection has occurred.
Will my VPN protect my cookies if an infostealer is already running?
No. Once an infostealer executes on the device, it copies cookie files from browser storage and reads data from memory — operations that are entirely local and invisible to a VPN. VPN protects the network channel; it cannot see or block what programmes already running on your machine are doing.
How do I spot a fake CAPTCHA in two seconds?
Ask one question: is this asking me to do something in the operating system — open a window, press a keyboard shortcut, paste something into a command line? If yes, it is fake. Close the tab immediately. A real CAPTCHA never leaves the browser.