ClickFix: the fake CAPTCHA that makes you hack yourself
A fake "verify you're human" box asks you to paste a command and press Enter. Your antivirus stays quiet, because you ran it yourself. One rule stops all of it.
· 6 min read
There is an attack going around that doesn't break into your computer. It asks you to do it, and you agree, because the request looks completely routine.
It's called ClickFix, and in the first half of 2025 it grew by 517%.
The setup
You land on a page. Something small is wrong, in a way you've seen a hundred times before:
- A "verify you are human" box that spins and fails.
- A video that won't play: "your browser is missing a codec".
- A document that won't open: "click to fix the display error".
- A site that says your browser is out of date.
None of it is alarming. That's the design. A dramatic warning makes people suspicious; a minor technical hiccup makes people compliant. You've fixed a dozen of these before.
The ask
Then comes the instruction, presented as the fix:
- Press Windows + R
- Press Ctrl + V
- Press Enter
On a Mac it's Terminal instead of the Run dialog. On Linux, a shell. Sometimes it's dressed up as a "verification code" you need to paste to prove you're not a bot.
What you don't see is that the page already put something on your clipboard. Ctrl+V isn't pasting a verification code. It's pasting a command — usually one that downloads and runs a program from somewhere else, padded with enough spaces that the visible part looks harmless if you glance at it.
Press Enter and you have installed it. Personally. With your own permissions.
Why your antivirus doesn't stop it
This is the clever part, and it's worth understanding rather than just fearing.
Security software is built around a question: did something happen that the user didn't ask for? A program writing to a system folder unprompted, a download executing itself, a browser spawning a shell — all suspicious, all flagged.
ClickFix produces none of those signals. There is no exploit, no drive-by download, no software vulnerability anywhere in the chain. A human opened a legitimate system dialog and ran a command. From the operating system's point of view, that is Tuesday.
The attack doesn't defeat your security software. It goes around it, using you as the delivery mechanism. This is why it's often described as social engineering rather than hacking — the only thing being exploited is the reasonable assumption that a small technical problem deserves a small technical fix.
How big is this?
ESET's threat report for the first half of 2025 put the growth at 517% compared with the previous period. That made ClickFix the second most common attack vector, behind only phishing, and it accounted for close to 8% of all blocked threats.
It works on Windows, macOS and Linux, because the technique doesn't depend on the platform — it depends on the person.
What arrives afterwards varies: infostealers that empty password managers and crypto wallets, ransomware, remote access trojans, cryptominers, and tooling used by nation-state groups. ClickFix is the front door. What comes through it is whoever bought access.
The one rule
Almost all of this collapses to a single sentence, and it's worth memorising rather than reasoning about in the moment:
A real CAPTCHA never asks you to open a Run dialog, a terminal, or paste anything.
That's it. Verifying you're human happens entirely inside the web page — you click a checkbox, you pick the bicycles, you do nothing at all while it checks how your mouse moved. It has never involved your operating system, because a web page proving you're human has no business executing commands on your computer.
The same applies to fixing a video, a codec, a font, or a display error. Legitimate sites do not solve their problems by having you run commands. If a page walks you through a keyboard sequence that leaves the browser, the page is the problem.
Two supporting habits:
- Treat a pre-filled clipboard as a warning. If you didn't copy anything and something is there, close the tab.
- Never paste into a terminal without reading it, in full, scrolled to the right. The dangerous part is often pushed off-screen behind whitespace.
If you already ran one: disconnect from the network, change passwords from a different device — starting with email and anything financial — and run a full scan. Infostealers work in seconds, so assume anything saved in the browser is gone.
Browsers are starting to help
Until recently, none of this was the browser's problem. That changed on 2 July 2026, when Opera shipped Paste Protect, the first native defence against clipboard attacks in a major browser. It watches for suspicious commands being copied from web pages, blocks the content before it reaches the clipboard, and tells you an attempt was made. It's on by default.
It's a good feature and it demonstrates the point: the moment of protection has to be the moment of the copy, not an article you read last month. Most people are not using Opera, though, and the other major browsers have not yet followed.
What the extension will do
Can I Throw This? will watch for the ClickFix shape specifically: a page writing a command to your clipboard, and instructions telling you to open a system dialog and paste it.
When it sees that combination, it will say plainly what is happening — that the page has put a command on your clipboard and is asking you to run it, and that no genuine verification ever requires this — at the moment you're being asked, which is the only moment the warning is any use.
Detection runs on your device. Recognising this pattern requires looking at the page in front of you, not at your browsing history.