You've clicked a thousand of them without a second thought. "I'm not a robot." Check the box, maybe pick out a few traffic lights, and you're through. That little test is supposed to prove you're human. So it's almost cruel that scammers have turned it into a trap.
Fake CAPTCHA pages are now being used in something called ClickFix attacks, and they flip that familiar, trusted moment against you. Instead of proving you're human, the page quietly walks you through running a malicious command on your own computer. What looks like a routine "verify you're human" step can be the opening move of a malware infection. And it's spreading fast. Security firm ESET recorded a 517% jump in ClickFix and fake-CAPTCHA campaigns in a single six-month stretch. So this isn't a rare edge case anymore. It's everywhere.
What Are Fake CAPTCHA Tests?
A real CAPTCHA keeps it simple. It asks you to identify some images, pick out the objects, or type a few distorted characters. Annoying sometimes, but harmless. It never leaves the web page.
A fake CAPTCHA copies that familiar look almost perfectly, then sneaks in an extra step that a real one would never include. Instead of just finishing the puzzle, the page tells you to do something on your actual computer. It might instruct you to press Windows + R, then paste something into the box that appears, using Ctrl + V, then hit Enter, followed by a few more keyboard steps. It all sounds like part of the "verification." It isn't. As Malwarebytes explains in its breakdown of fake CAPTCHA scams, those extra keystrokes quietly cause you to run a malicious command with your own hands. You become the one who installs the malware, which is exactly what makes it so sneaky.
How ClickFix Attacks Work
Here's the mechanism, and it's clever in a nasty way. When you land on the fake page, a hidden script silently copies a malicious command onto your clipboard. You don't see it happen. There's no download, no obvious file, nothing your antivirus is watching for in that instant.
Then the page gives you the steps. Windows + R opens the Run dialog, that little command box built into Windows. Ctrl + V pastes the hidden command that's already sitting on your clipboard. And Enter runs it. In those three keystrokes, your computer reaches out to a remote server and pulls down the real payload, often an infostealer that quietly grabs your passwords, banking logins, and browser data. Some newer versions even fake a full Windows blue-screen error and tell you the command will "fix" your PC. A Philadelphia CBS News report documented real people getting caught by exactly this trick. You think you're solving a puzzle or fixing an error. You're actually running the attacker's code.
How to Spot a Fake CAPTCHA
The good news is that these attacks have a giant tell, once you know to look for it. A real CAPTCHA never touches your operating system. Ever.
Watch for Unusual Instructions
So treat it as a serious red flag the moment a "CAPTCHA" asks you to do anything with your computer's own tools. Specifically, be on guard if a verification step tells you to open the Run dialog, copy and paste a command, open PowerShell or Command Prompt, press unusual keyboard combinations, execute code of any kind, or download and install software to "complete" the check. None of that belongs in a CAPTCHA. A genuine one lives entirely inside the web page and asks for nothing more than a click or a bit of typing into its own box. The second a test reaches outside the browser and into your system, you're not looking at security. You're looking at an attack.
How to Stay Safe From ClickFix Attacks
Staying safe here is mostly about one habit. Slow down when something asks you to run a command, and don't do it. That single pause defeats almost every version of this scam, because the attack only works if you cooperate.
Beyond that, a few things help. Keep your operating system and browser updated so known tricks get patched. Run reputable security software that can catch the payload if you do slip. Be extra skeptical of pop-ups and pages that create urgency or claim your system is broken and needs a quick fix, since panic is exactly what they're counting on.
If a page ever prompts you toward the Run dialog or PowerShell, close the whole tab and walk away. On June 8, the FTC put out a public warning about these fake CAPTCHA pages telling people to run hidden commands that install malware and expose email and banking data, so government agencies are taking it seriously too. Guidance from Microsoft Security and CISA is worth following if you want to go deeper, and you can even see the trick demonstrated in this short reel.
A CAPTCHA Should Never Ask You to Run Commands
If you remember nothing else from this, remember this one line. A CAPTCHA should never ask you to run commands. Full stop.
That's the rule that keeps you safe, because it needs no technical knowledge at all. You don't have to understand PowerShell or clipboards or shellcode. You just have to know that a legitimate "prove you're human" test asks you to click a box or read some characters, and absolutely nothing else. The instant it wants keyboard shortcuts, a Run dialog, or a command pasted anywhere, it has stopped being a CAPTCHA and become a con. Close it.
Conclusion
Scammers succeeded here by hijacking something we all trust and barely think about. That's what makes fake CAPTCHA and ClickFix attacks so effective, and why they've exploded in the past year. But their biggest strength is also their fatal weakness. These attacks can't do anything unless you follow the instructions yourself.
So take the small amount of caution it requires. Real verification stays in the browser and never asks you to touch your system's command tools. Learn that one boundary, share it with the less tech-savvy people in your life who are most at risk, and you shut the door on the whole scheme. In a world of increasingly clever tricks, sometimes the best defense is refusing to press Enter.
Top comments (0)