ClickFix Malware Campaigns Are Spreading Through Fake CAPTCHA Prompts on Windows and macOS

A malware technique known as ClickFix is spreading more widely by using fake CAPTCHA prompts to trick people into running malicious commands on their own computers.

The attack does not usually rely on a browser vulnerability. Instead, it uses social engineering. A website or malicious advertisement presents what looks like a normal verification step, then instructs you to perform actions outside the browser.

On Windows, that can include opening the Run dialog, pasting a command and pressing Enter. On macOS, similar campaigns direct people to open Terminal and execute commands there.

The important point is that the victim is persuaded to launch the malware manually.

Attack detail	What happens
Initial lure	Fake CAPTCHA or verification prompt
Windows method	Run dialog, PowerShell or Terminal
macOS method	Terminal commands
Delivery	Malicious command downloads additional code
Main weakness exploited	Social engineering
Key defence	Never run commands requested by a random website

Fake verification prompts make the attack believable

CAPTCHA tests and browser verification screens are common across the web, which makes them useful for attackers.

A malicious page can imitate these familiar prompts and claim that an additional step is required before you can continue.

On Windows, one version tells you to press Windows and R to open the Run dialog.

The page may already have copied a malicious command to the clipboard. It then asks you to paste that command with Ctrl and V before pressing Enter.

Once executed, the command can launch PowerShell and retrieve additional malware from the internet.

The browser itself may therefore appear to be doing very little. The dangerous part begins when the person follows instructions that move outside the browser.

Attackers are changing the method when defences improve

Blocking one Windows feature does not necessarily stop ClickFix style attacks.

For example, organisations can disable access to the Run command through Group Policy.

Attackers have responded with variants that use other Windows tools.

One version known as TerminalFix directs the victim toward the Windows power user menu and asks them to open a terminal or PowerShell window instead.

This illustrates why technical restrictions alone may not be enough.

Attackers can change the instructions while keeping the same basic social engineering strategy.

macOS is also being targeted

ClickFix is no longer limited to Windows.

Researchers have documented macOS versions that ask victims to open Terminal and execute copied commands.

Some of these commands may be partially encoded, making them difficult for an average person to understand before execution.

The technique works because macOS provides powerful command line tools that can download and run software when instructed to do so.

The operating system itself is not the central weakness in this type of attack.

The attacker is relying on the victim to approve and execute the command.

Clipboard access plays an important role

Many ClickFix campaigns depend on placing malicious text into the clipboard.

The victim is then instructed to paste it into a local system tool.

That means browser permissions and clipboard protections can help reduce exposure in some cases.

However, they cannot completely remove the risk if a person manually copies a command from a malicious page.

The safer approach is to treat any website instruction involving PowerShell, Terminal, Command Prompt or the Windows Run dialog as suspicious unless you fully understand why it is required.

Simple security habits can stop many ClickFix attacks

The strongest defence is recognising the pattern.

A normal CAPTCHA should be completed inside the browser.

A website should not need you to open PowerShell, Terminal, Command Prompt or Run in order to prove that you are human.

If a page tells you to paste commands into your computer, close the page instead.

Businesses can add technical controls such as restricting command line tools where appropriate, but user awareness remains important because attackers regularly change their instructions.

ClickFix succeeds by making an unusual action look routine.

Once you know that pattern, the attack becomes much easier to identify.

For most people, a simple rule is enough: if a website asks you to leave the browser and run a command on your computer, do not follow the instruction.