[ THREAT ]// fake captcha · clickfix

Fake CAPTCHAs.

“ClickFix” turns the most trusted box on the web — I'm not a robot — into a way to make you run malware by hand. Learn how it works, then survive a fully sandboxed demo.

Educational · no code is ever executed on this page

What is ClickFix?

A malicious or compromised site shows a convincing CAPTCHA. But the “checkbox” doesn't verify anything — it tells you the check failed and that you must complete a quick “human verification”: press Win + R, then Ctrl + V, then Enter. What you don't see: the page already copied a hidden command to your clipboard with JavaScript. You paste and run it yourself — straight into the Windows Run box — so no download warning, no attachment, no obvious red flag.

How the clipboard hijack works

1Page JS calls navigator.clipboard.writeText() with a hidden PowerShell one-liner the moment you click.

2Win + R opens the Run dialog — a trusted OS prompt, not the browser.

3Ctrl + V pastes the payload. The visible text is often padded with spaces so the real command scrolls off-screen.

4Enter executes it. PowerShell quietly downloads and runs the next stage.

What the payloads do & who uses it

Typical second stages: install a RAT (remote access trojan), drop an infostealer that harvests browser passwords, cookies and crypto wallets, or join the machine to a botnet.

Documented 2024–2025 campaigns used fake Google/Cloudflare CAPTCHAs, bogus “fix this document” pages, and fake browser-update prompts to spread Lumma, StealC and DarkGate. The technique is tracked as ClickFix / “paste-and-run.”

[ DEMO ]// sandboxed — follow the steps, get clickfixed (safely)

● sandbox · nothing runs

Verify you are human

I'm not a robot

nullCAPTCHA
Privacy · Terms

⚠ Verification failed. Complete these steps to confirm you're human:

Press Win + R
Press Ctrl + V
Press Enter

Run

Type the name of a program, and Windows will open it for you.

Open:

OKCancelBrowse…

Windows PowerShell

💀 You just got ClickFixed — here's exactly what happened

The checkbox

It never verified anything. Clicking it ran JavaScript that silently wrote a command to your clipboard and swapped the box for fake “failure” instructions.

Win + R

Moved you out of the browser sandbox into a trusted OS dialog that can launch anything — no security prompt.

Ctrl + V

Pasted the hidden payload. In a real attack the command starts with lots of spaces so you only see something harmless like ✅ I am not a robot while powershell -w hidden -enc … hides off-screen.

Enter

You executed it yourself. Because you typed it, there's no download, no attachment scan, and you're far less suspicious than if a file had appeared.

Why it works

It hijacks a trusted ritual (CAPTCHAs), creates mild urgency (“verification failed”), and makes the action self-inflicted — the strongest social-engineering lever there is.

Defend yourself

A real CAPTCHA never asks you to press Win+R or paste anything. If a “human check” wants keyboard shortcuts, close the tab. Compare with other phishing red flags, and see what these payloads look like in the PowerShell console.