ClickFix: How a Fake CAPTCHA Tricks Victims into Infecting Their Own Computers

Not long ago, ClickFix attacks seemed like a rare curiosity, but now the method has gone mainstream — attackers have come to appreciate its simplicity and effectiveness against users of both Windows and macOS. The attack requires little: a compromised site, a fake CAPTCHA window, and just one terminal command. Far too many people obediently copy and run it, which is why the technique has been adopted by nearly every distributor of malware.

Independent researcher Kevin Beaumont notes that Reddit has filled up with accounts from people whose computers were infected in exactly this way, and that legitimate sites around the world are being hacked to display bogus CAPTCHA prompts.

Why People Fall for It

Experienced users tend to chalk it all up to the gullibility of the victims. But the author of the piece offers a different view: using the internet has become so agonizing — banners that are impossible to close, endless image-based CAPTCHAs, constantly changing interfaces — that less sophisticated users have simply grown accustomed to carrying out absurd and burdensome instructions. It is this fatigue that the attackers exploit.

The scheme is typical: the victim sees a verification window, often disguised as Cloudflare. After interacting with it, a line of text appears (frequently obfuscated to hide the malicious command), which they are prompted to paste into Windows Run, PowerShell, or the macOS terminal and press Enter. The instructions come from sites the person has used for years, and they look no more suspicious than what has been demanded of them for the past decade.

Less Effort for the Attackers

For attackers, ClickFix has dramatically simplified the task. According to BlueVoyant, installing malware (tracked as Lorem Ipsum) used to require resource-intensive infrastructure: download portals with rigged SEO and malicious ads, trusted Microsoft signing certificates, and constantly rotating domains. The shift to ClickFix at the end of May 2026 removed the code-signing requirement entirely: the legitimacy of a signed installer was replaced by the user themselves, voluntarily running the command in their own terminal. This expands the pool of victims from those searching for Microsoft Teams to anyone who visits a compromised site.

Mac users are no better off: Jamf and other researchers have documented ClickFix variants for macOS that bypass Gatekeeper protection.

Attackers are inventive in their use of public services — from published Google Sheets documents (Cisco Talos) to command-and-control infrastructure in blockchain smart contracts, which is also relied on by the Russian state group Sandworm. Netskope counted 5,400 sites reaching out to one such campaign.

What to Do

There are plugins and built-in defenses. For example, BlockBlock can block ClickFix on a Mac as soon as ⌘+V is pressed, and a similar feature has been added to uBlock. But the author's main takeaway is this: blaming and shaming victims is pointless — it only makes the problem worse. Those who have the training should educate their less experienced relatives and acquaintances, because the mass spread of ClickFix has proven its effectiveness, and the method is not going anywhere anytime soon.

Source: Ars Technica