ClickFix Attacks in the Browser: How to Spot and Block Fake Fix Prompts

You're reading a page, a dialog pops up saying your browser is out of date, or a security scan found "3 critical threats," and the fix is a single button. Paste this command into the Run box. Click "Verify you are human." Copy and paste the code shown below. It feels routine, almost like a reflex. That reflex is exactly what a ClickFix browser attack is designed to exploit.

ClickFix attacks have grown quickly because they skip the hard parts of malware delivery. Instead of tricking someone into downloading and running an executable, they convince the victim to run the malicious command themselves, using tools already built into their operating system. Security researchers have tracked campaigns that used fake CAPTCHA pages, fake browser update warnings, and fake error screens to get people to open PowerShell or the Windows Run dialog and paste a payload. Because the user performs the final step, many traditional defenses, including download scanning and some email filters, never see the threat in a clear form.

This article explains how a ClickFix browser attack works, what the most common lures look like, and how to spot them before you act. It also walks through a concrete checklist for blocking them on a personal machine and a company network, and it covers what to do if you already pasted something you shouldn't have. If you only remember one rule, make it this: a website has no legitimate reason to ask you to paste a command into your own computer. Everything below builds on that idea.

Key Takeaways

• A ClickFix browser attack tricks you into copying a command from a web page and running it yourself, usually through the Run dialog, PowerShell, or Terminal.
• No real CAPTCHA, browser update, or verification step ever asks you to paste code into your system. Treat that request as the warning sign itself.
• Check the clipboard before you paste anywhere. If the text contains commands like powershell, mshta, or curl | bash, stop.
• Disable or restrict the Run dialog and use managed policies on shared or work machines where possible.
• Use a password manager and passkeys so that even if you are lured, a single compromise does not expose everything.
• If you already ran something, isolate the device first, then rotate credentials from a clean device.

What Is a ClickFix Browser Attack?

A ClickFix browser attack is a social engineering technique in which a malicious web page displays a fake error, verification prompt, or update notice and instructs the visitor to copy a snippet of text and run it on their own device. The text is usually a one-line command that downloads and executes a second-stage payload, such as an infostealer, a remote access trojan, or a loader for ransomware.

The name reflects the sequence the attacker wants: the victim clicks a "fix" button, the page silently copies the malicious command to the clipboard, and the victim pastes it in the place the page tells them to. The attack depends on three things working together: a convincing lure, a clipboard write triggered by a click, and a system tool that will execute the pasted text.

Several features make this technique effective:

• It needs no exploit. The browser and operating system are not broken. The user is the delivery mechanism.
• It uses trusted tools. PowerShell, the Windows Run dialog, and macOS Terminal are legitimate programs, so the activity looks less suspicious than a dropped .exe file.
• It bypasses download controls. Many email and web gateways scan files. A pasted command is text, and text is harder to flag.
• It scales. The same fake CAPTCHA template can be placed on compromised sites, malvertising networks, or lookalike domains with little effort.

The Most Common ClickFix Lures You Will Actually See

ClickFix campaigns vary, but they tend to reuse a handful of pretexts. Recognizing the pattern is more reliable than memorizing individual domains, because attackers rotate those constantly.

Fake CAPTCHA or "I am not a robot" pages

The page shows a checkbox or button labeled "Verify you are human." After you click, it displays instructions such as "Press Win + R, paste the text, and press Enter to continue." Real CAPTCHA systems solve challenges inside the browser. They never ask you to open another application.

Fake browser or plugin updates

A full-page overlay claims your browser, video player, or font package is out of date. The "update" instruction is a command to paste into a terminal. Legitimate updates arrive through the browser's own update mechanism or the operating system's update service, not through a web page asking for a shell command.

Fake error or repair screens

Imitations of "Application failed to load" or "Document cannot be displayed" messages suggest a repair command. Some copy the visual style of Windows error dialogs closely enough to fool a quick glance.

Fake security scans

A page reports "malware detected" with a count of threats and recommends a cleanup script. The scanner is the attack. Real security software does not need you to paste anything to remove detected threats.

How to Spot a ClickFix Attack Before You Act

Most ClickFix pages share a small set of tells. None of them alone proves an attack, but two or more should stop you cold.

1. The page asks you to open a system tool. Any instruction mentioning Win + R, the Run dialog, PowerShell, Command Prompt, or Terminal is a red flag on a website.
2. The page asks you to paste something. Copy and paste is the core of the attack. A verification step that requires pasting a command is not verification.
3. The text looks like code. Look for powershell -w hidden, mshta http, iex, curl ... | sh, bitsadmin, or long Base64 strings.
4. The page is full-screen or blocks scrolling. Overlays that prevent you from leaving are designed to create urgency.
5. The domain is unfamiliar or misspelled. Lookalike domains and newly registered sites are common, especially when they ride on ads.
6. The request follows a redirect from an ad or search result. Many lures are delivered through malvertising or SEO-poisoned results.

The clipboard check

Before pasting anything into a terminal, paste it into a plain text editor first, such as Notepad or TextEdit, and read it. If it contains a single long line with URLs, encoded strings, or flags like -enc or -nop, do not run it. A regular command for a legitimate tool is almost always short, readable, and tied to a named vendor.

Worked Example: Tracing a Fake CAPTCHA Attack

Consider a realistic scenario. A user, Priya, searches for a PDF converter and clicks a sponsored result. She lands on a page that says "Confirm you are human to download your file" with a checkbox. After she clicks it, a message appears: "Press Win + R, press Ctrl + V, then press Enter." The clipboard already contains a PowerShell command.

Here is what happens if she follows the steps:

1. The command launches PowerShell with hidden windows and downloads a script from an external server.
2. The script drops an infostealer that searches the browser profile for saved passwords and session cookies.
3. Within minutes, the malware sends her stored credentials to the attacker.

Now compare a safer path. Priya notices the instruction to open the Run dialog and paste text, which a converter never requires. She closes the tab, checks her browser's history to see which ad led her there, and runs a scan. She then changes passwords for any accounts saved in that browser, starting with email, because email is the account that controls password resets everywhere else.

The difference between these two outcomes is a single decision made in about five seconds. That is why the habit matters more than any individual tool.

Blocking ClickFix Attacks: Personal Devices and Work Machines

Awareness is the first layer. Technical controls are the second. Use both, because people get tired and rushed.

Personal devices (Windows)

1. Keep Windows and your browser on automatic updates so you are not tempted by fake update prompts.
2. Turn on Microsoft Defender SmartScreen in Windows Security, under App and browser control, to flag known malicious sites and downloads.
3. Use an ad blocker and avoid clicking sponsored results for software downloads. Go directly to the vendor's domain.
4. Consider restricting who can run PowerShell by using Windows Defender Application Control or AppLocker in environments where you have the skill to configure them. For most home users, keeping the default settings and not running unknown commands is the practical limit.
5. Store passwords in a dedicated manager rather than the browser's built-in store, so one infostealer does not harvest everything at once.

Personal devices (macOS)

1. Keep macOS current and enable Gatekeeper, which is on by default.
2. Be suspicious of any site asking you to open Terminal and paste a command. Legitimate software installers use signed packages.
3. Use Safari's fraudulent website warning or a reputable third-party blocker, and consider a DNS-level filter for families.

Work and shared machines

• Use Group Policy or endpoint management to restrict the Run dialog and PowerShell execution policy on machines that do not need them.
• Enable script block logging and monitor for encoded PowerShell commands launched from browser processes.
• Run a phishing awareness course that specifically covers fake CAPTCHA and paste-to-fix lures, not just email phishing.
• Block newly registered domains and known malvertising categories at the secure web gateway.

Comparison: Which Defenses Stop ClickFix Best?

No single control is enough. The table below compares common defenses against the stages of a ClickFix attack. Ratings are practical judgments for typical home and small-office setups, not vendor benchmarks.

Defense	Blocks the lure page	Blocks the paste step	Blocks execution	Setup effort	Works on personal devices
Browser fraud warnings (SmartScreen, Safe Browsing)	Sometimes, for known sites	No	No	Low	Yes
DNS filtering	Yes, for known bad domains	No	No	Low to medium	Yes
Restricting the Run dialog and PowerShell	No	No	Yes	High	Limited
Endpoint detection and response (E Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.