[{"data":1,"prerenderedAt":238},["ShallowReactive",2],{"learn-\u002Flearn\u002Fclickfix-fake-captcha":3,"learn-around-\u002Flearn\u002Fclickfix-fake-captcha":233},{"id":4,"title":5,"body":6,"category":210,"description":211,"draft":212,"extension":213,"meta":214,"navigation":215,"path":216,"publishedAt":217,"readingTime":218,"seo":219,"sources":220,"stem":230,"updatedAt":231,"__hash__":232},"learn\u002Flearn\u002Fclickfix-fake-captcha.md","ClickFix: the fake CAPTCHA that makes you hack yourself",{"type":7,"value":8,"toc":199},"minimark",[9,13,21,26,29,45,48,52,55,77,80,83,86,90,93,101,104,107,111,122,125,128,132,135,142,145,148,151,165,172,176,183,186,190,193,196],[10,11,12],"p",{},"There is an attack going around that doesn't break into your computer. It asks you to do it, and\nyou agree, because the request looks completely routine.",[10,14,15,16,20],{},"It's called ",[17,18,19],"strong",{},"ClickFix",", and in the first half of 2025 it grew by 517%.",[22,23,25],"h2",{"id":24},"the-setup","The setup",[10,27,28],{},"You land on a page. Something small is wrong, in a way you've seen a hundred times before:",[30,31,32,36,39,42],"ul",{},[33,34,35],"li",{},"A \"verify you are human\" box that spins and fails.",[33,37,38],{},"A video that won't play: \"your browser is missing a codec\".",[33,40,41],{},"A document that won't open: \"click to fix the display error\".",[33,43,44],{},"A site that says your browser is out of date.",[10,46,47],{},"None of it is alarming. That's the design. A dramatic warning makes people suspicious; a minor\ntechnical hiccup makes people compliant. You've fixed a dozen of these before.",[22,49,51],{"id":50},"the-ask","The ask",[10,53,54],{},"Then comes the instruction, presented as the fix:",[56,57,58],"blockquote",{},[59,60,61,67,72],"ol",{},[33,62,63,64],{},"Press ",[17,65,66],{},"Windows + R",[33,68,63,69],{},[17,70,71],{},"Ctrl + V",[33,73,63,74],{},[17,75,76],{},"Enter",[10,78,79],{},"On a Mac it's Terminal instead of the Run dialog. On Linux, a shell. Sometimes it's dressed up as\na \"verification code\" you need to paste to prove you're not a bot.",[10,81,82],{},"What you don't see is that the page already put something on your clipboard. Ctrl+V isn't pasting\na verification code. It's pasting a command — usually one that downloads and runs a program from\nsomewhere else, padded with enough spaces that the visible part looks harmless if you glance at\nit.",[10,84,85],{},"Press Enter and you have installed it. Personally. With your own permissions.",[22,87,89],{"id":88},"why-your-antivirus-doesnt-stop-it","Why your antivirus doesn't stop it",[10,91,92],{},"This is the clever part, and it's worth understanding rather than just fearing.",[10,94,95,96,100],{},"Security software is built around a question: ",[97,98,99],"em",{},"did something happen that the user didn't ask\nfor?"," A program writing to a system folder unprompted, a download executing itself, a browser\nspawning a shell — all suspicious, all flagged.",[10,102,103],{},"ClickFix produces none of those signals. There is no exploit, no drive-by download, no software\nvulnerability anywhere in the chain. A human opened a legitimate system dialog and ran a command.\nFrom the operating system's point of view, that is Tuesday.",[10,105,106],{},"The attack doesn't defeat your security software. It goes around it, using you as the delivery\nmechanism. This is why it's often described as social engineering rather than hacking — the only\nthing being exploited is the reasonable assumption that a small technical problem deserves a\nsmall technical fix.",[22,108,110],{"id":109},"how-big-is-this","How big is this?",[10,112,113,114,117,118,121],{},"ESET's threat report for the first half of 2025 put the growth at ",[17,115,116],{},"517%"," compared with the\nprevious period. That made ClickFix the ",[17,119,120],{},"second most common attack vector",", behind only\nphishing, and it accounted for close to 8% of all blocked threats.",[10,123,124],{},"It works on Windows, macOS and Linux, because the technique doesn't depend on the platform — it\ndepends on the person.",[10,126,127],{},"What arrives afterwards varies: infostealers that empty password managers and crypto wallets,\nransomware, remote access trojans, cryptominers, and tooling used by nation-state groups.\nClickFix is the front door. What comes through it is whoever bought access.",[22,129,131],{"id":130},"the-one-rule","The one rule",[10,133,134],{},"Almost all of this collapses to a single sentence, and it's worth memorising rather than\nreasoning about in the moment:",[56,136,137],{},[10,138,139],{},[17,140,141],{},"A real CAPTCHA never asks you to open a Run dialog, a terminal, or paste anything.",[10,143,144],{},"That's it. Verifying you're human happens entirely inside the web page — you click a checkbox,\nyou pick the bicycles, you do nothing at all while it checks how your mouse moved. It has never\ninvolved your operating system, because a web page proving you're human has no business\nexecuting commands on your computer.",[10,146,147],{},"The same applies to fixing a video, a codec, a font, or a display error. Legitimate sites do not\nsolve their problems by having you run commands. If a page walks you through a keyboard sequence\nthat leaves the browser, the page is the problem.",[10,149,150],{},"Two supporting habits:",[30,152,153,159],{},[33,154,155,158],{},[17,156,157],{},"Treat a pre-filled clipboard as a warning."," If you didn't copy anything and something is\nthere, close the tab.",[33,160,161,164],{},[17,162,163],{},"Never paste into a terminal without reading it",", in full, scrolled to the right. The\ndangerous part is often pushed off-screen behind whitespace.",[10,166,167,168,171],{},"If you already ran one: disconnect from the network, change passwords from a ",[97,169,170],{},"different"," device —\nstarting with email and anything financial — and run a full scan. Infostealers work in seconds,\nso assume anything saved in the browser is gone.",[22,173,175],{"id":174},"browsers-are-starting-to-help","Browsers are starting to help",[10,177,178,179,182],{},"Until recently, none of this was the browser's problem. That changed on 2 July 2026, when Opera\nshipped ",[17,180,181],{},"Paste Protect",", the first native defence against clipboard attacks in a major browser.\nIt watches for suspicious commands being copied from web pages, blocks the content before it\nreaches the clipboard, and tells you an attempt was made. It's on by default.",[10,184,185],{},"It's a good feature and it demonstrates the point: the moment of protection has to be the moment\nof the copy, not an article you read last month. Most people are not using Opera, though, and the\nother major browsers have not yet followed.",[22,187,189],{"id":188},"what-the-extension-will-do","What the extension will do",[10,191,192],{},"Can I Throw This? will watch for the ClickFix shape specifically: a page writing a command to\nyour clipboard, and instructions telling you to open a system dialog and paste it.",[10,194,195],{},"When it sees that combination, it will say plainly what is happening — that the page has put a\ncommand on your clipboard and is asking you to run it, and that no genuine verification ever\nrequires this — at the moment you're being asked, which is the only moment the warning is any\nuse.",[10,197,198],{},"Detection runs on your device. Recognising this pattern requires looking at the page in front of\nyou, not at your browsing history.",{"title":200,"searchDepth":201,"depth":201,"links":202},"",2,[203,204,205,206,207,208,209],{"id":24,"depth":201,"text":25},{"id":50,"depth":201,"text":51},{"id":88,"depth":201,"text":89},{"id":109,"depth":201,"text":110},{"id":130,"depth":201,"text":131},{"id":174,"depth":201,"text":175},{"id":188,"depth":201,"text":189},"security-threats","A fake \"verify you're human\" box asks you to paste a command and press Enter. Your antivirus stays quiet, because you ran it yourself. One rule stops all of it.",false,"md",{},true,"\u002Flearn\u002Fclickfix-fake-captcha","2026-09-20",6,{"title":5,"description":211},[221,224,227],{"label":222,"url":223},"ESET Threat Report H1 2025","https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Feset-threat-report-h1-2025\u002F",{"label":225,"url":226},"ESET newsroom: ClickFix fake error surges, spreads ransomware and other malware (June 2025)","https:\u002F\u002Fwww.eset.com\u002Fus\u002Fabout\u002Fnewsroom\u002Fresearch\u002Feset-threat-report-clickfix-fake-error-surges-spreads-ransomware-and-other-malware\u002F",{"label":228,"url":229},"Opera: introducing Paste Protect (2 July 2026)","https:\u002F\u002Fblogs.opera.com\u002Fnews\u002F2026\u002F07\u002Fopera-introduces-paste-protect-to-keep-you-safe-from-clipboard-attacks\u002F","learn\u002Fclickfix-fake-captcha",null,"Pliaw_sI2-r7R2EfHizY8tMVhZs04b1i7T1oAME7gGo",[231,234],{"title":235,"path":236,"stem":237,"children":-1},"Cookie banners and how to actually say no","\u002Flearn\u002Fcookie-banners-real-rejection","learn\u002Fcookie-banners-real-rejection",1790177868890]