The newest fake CAPTCHA may look like an annoying little hurdle. The danger begins when it asks you to do something outside the browser to clear it.
That is the core of a ClickFix attack: a compromised or look-alike site presents a convincing verification, update, or error screen; the screen copies a command to the clipboard; and the victim is instructed to paste it into Windows Run, PowerShell, Windows Terminal, or macOS Terminal. The command then starts the infection under the victim’s own account.
This is not a software bug that needs a patch. It is a social-engineering method designed to make a risky command feel like ordinary troubleshooting. Recent Ars Technica reporting says the technique is now widely used against both PCs and Macs. Microsoft’s latest research shows a macOS operation adding browser fingerprinting so its fake “Download for macOS” page is served mainly to visitors who look like genuine Mac users.
That extra selectivity is an important signal: the prompt may be invisible to a casual scan of a site, while still being very real to the intended visitor.
The rule worth memorising
A legitimate CAPTCHA or Cloudflare-style check may ask you to tick a box, choose images, wait for a browser check, or sign in. It does not ask you to open a system tool, use a keyboard shortcut, paste text, or run a command.
New Zealand’s National Cyber Security Centre makes the same distinction in its current advisory on compromised sites: fake CAPTCHA and Turnstile pages are being used to get visitors to execute commands that install information stealers and other malware. It is a much cleaner consumer rule than trying to inspect every line of mysterious code.
| If a page says… | Treat it as… | What to do instead |
|---|---|---|
| “Press Windows + R, then paste” | A malicious instruction | Close the tab; do not open Run. |
| “Open Terminal to verify you are human” | A malicious instruction | Close the tab; a CAPTCHA has no reason to need Terminal. |
| “Copy this PowerShell command to fix/download/update” | A high-risk social-engineering lure | Get the app or update from its official site or built-in updater. |
| “Paste this to complete Cloudflare verification” | A fake verification page | Leave the site and check its address independently. |
The wording will change. The boundary should not.
Why this trick works
ClickFix works because online friction has trained people to follow arbitrary steps. Pop-ups, broken download links, sign-in loops and endless verification puzzles make an unusual instruction feel plausible when the page presents it with confidence.
But a pasted command is qualitatively different from clicking a page button. It can fetch a second-stage program, change settings, or hand over data without the usual install flow that gives people a chance to stop. On macOS, Microsoft says the Terminal-led approach can sidestep parts of the normal downloaded-app trust path, including the checks commonly associated with a downloaded application bundle.
That does not mean every command is malware, nor that Macs have suddenly become uniquely unsafe. It means the scam is deliberately moving the user outside the place where browser and download warnings are most familiar.
What to do if you encounter one
If you have only seen the prompt, close the browser tab. There is no need to complete its fake task. If the site is one you genuinely need, type its known address yourself later or reach it from a trusted bookmark rather than refreshing the suspicious page.
If you pasted a command but did not run it, close the system tool and avoid pasting the clipboard elsewhere. If you ran it, disconnect from the network if practical, use a known-clean device to change important passwords, and start with your operating system’s built-in security scan. Work or school devices should be reported to the responsible IT team promptly; do not try to “clean” a possible incident silently.
For the people around you, this is a better conversation than “don’t click strange links.” The useful sentence is: websites never need you to paste code to prove you are human. It is specific enough to remember when a fake prompt arrives at exactly the wrong moment.
Bottom line
ClickFix succeeds by making the victim perform the dangerous step. That makes its defense unusually straightforward: never paste commands from a webpage into Run, PowerShell, Command Prompt, or Terminal just to view content, finish a CAPTCHA, install an update, or fix an error.
Treat that request as the warning—not as the task you need to solve.