Blog

"Verify you are human" by pasting this? The ClickFix trick that makes you install malware yourself

26 October 2026 · 2 min read

Imagine opening a link from an invoice email and seeing a familiar box: *"Verify you are human."* Instead of ticking a checkbox, it says: press Windows + R, press Ctrl + V, press Enter. It looks like a slightly unusual CAPTCHA.

It isn't. You have just pasted and run a command that downloads malware.

Microsoft Threat Intelligence published a detailed analysis of this technique, called ClickFix, in August 2025. Its key point: because the person runs the command themselves, many security tools that would block a malicious download never get the chance.

How people end up there

According to Microsoft, ClickFix lures arrive through:

• phishing emails, often with fake invoices or payment notices, sometimes posing as government agencies;
• malicious ads on free or pirated streaming sites;
• hacked legitimate websites that suddenly show a fake verification box.

The prompts vary: a fake CAPTCHA, a "browser update failed" message, a document that "can't be displayed" until you run a fix.

What it installs

Most often, information stealers such as Lumma Stealer, which grab saved passwords, browser sessions and crypto wallets. Microsoft also saw remote-access tools and loaders that open the door for more attacks, on Windows and macOS.

The five-second rule

No real website ever asks you to copy a command into Run, Terminal or PowerShell to prove you're human or to read a document. If a page tells you to press Windows + R, or to open Terminal and paste something, close the tab.

If you already did it:

1. disconnect the computer from the network;
2. tell your IT contact straight away;
3. from a different, clean device, change the passwords for email, banking and anything else saved in the browser, and sign out of other sessions.

For whoever manages the computers

Microsoft's own recommendations include restricting the Run dialog where people don't need it, turning on PowerShell logging and script execution policies, using attack-surface-reduction rules, and making sure users understand what they copy and paste. On the email side, filtering links and attachments before they reach people removes many of the starting points.

KnoxDefender filters incoming mail for the invoice and payment lures these campaigns use, re-checks links when they are clicked (with link protection on), and its "Suspicious links" and "Unexpected attachments" courses teach the habit that matters most here: stop when a page asks you to do something unusual to see a document.

Source

• Microsoft Threat Intelligence: Think before you Click(Fix): analyzing the ClickFix social engineering technique (21 August 2025)

← All stories · Questions? Contact us.