ClickFix Fake CAPTCHA Malware: What to Do After "Verify You Are Human" Asks for Win+R

What should I do right now if someone pasted the command?

If an employee pressed Win+R, pasted, and hit Enter, treat that PC as infected. Pull the network cable or turn off Wi-Fi, but leave the machine powered on. Don’t run the command again, don’t wipe the PC, and don’t start deleting things. Call IT now. Then change passwords from a different device.

In order:

1. Disconnect it. Unplug the network cable or switch off Wi-Fi. That cuts the attacker’s connection and stops more data leaving.
2. Leave it on and leave it alone. A running machine still holds evidence. If you have EDR, your IT team can investigate and isolate it remotely. Wiping it now destroys the record of what ran.
3. Take a phone photo of the fake page and the instructions if they’re still on screen. Note the time and the website.
4. Call IT. Tell them exactly what was pasted and when. This is what an incident response plan is for.
5. Reset passwords from a clean device. Start with email, then banking and anything saved in that browser. The usual payload steals saved passwords and more (see below), so have IT also sign the account out of every session, not just change the password.
6. Warn whoever moves money. Stolen email logins lead straight to business email compromise. For the next few weeks, verify every new or changed payment instruction by phone, the way our wire verification guide lays out.

If the employee clicked the checkbox but never pasted anything, the command was only copied to the clipboard. Close the browser, don’t paste, and still tell IT so they can block the site.

How does the ClickFix "Verify you are human" trick work?

ClickFix gets the victim to run the attacker’s command for them. The page looks like a normal CAPTCHA. When you tick the box, a script on the page copies a hidden command to your clipboard. Then it shows “verification steps”: press Windows+R, press Ctrl+V, press Enter. Those three keys run the command.

CISA and the FBI described the same steps in their May 21, 2025 LummaC2 advisory: a fake CAPTCHA “contains instructions for users to then open the Windows Run window (Windows Button + R) and paste clipboard contents,” and pressing Enter starts an encoded PowerShell process.

Microsoft’s August 21, 2025 analysis of ClickFix adds three things a business owner should know:

• It’s common. Microsoft says it has seen ClickFix campaigns “targeting thousands of enterprise and end-user devices globally every day.”
• The command uses tools already on Windows, like PowerShell and mshta. Nothing looks like a download, which is why plain antivirus can miss it.
• The script varies. Some versions ask you to paste into PowerShell or Windows Terminal instead of the Run box, and a June 2025 campaign targeted Mac users.

People fall for it because it borrows trust. Everyone has clicked a real “I’m not a robot” box, and the fake one shows up on a hacked legitimate website, a malicious ad, or a link in an email. Nothing about it feels like opening an attachment.

What does ClickFix malware actually install?

Most often it installs an infostealer or a remote access tool. Microsoft lists Lumma Stealer as the most prolific ClickFix payload, plus remote access trojans like Xworm, AsyncRAT, and NetSupport, and loaders that pull down more malware later.

According to CISA’s LummaC2 advisory, LummaC2 takes personal information, financial credentials, cryptocurrency wallets, browser extensions, and multifactor authentication details. That’s why step 5 above says to reset passwords from another device and kill sessions. On a compromised PC, anything you type next goes to the attacker too.

The Justice Department seized LummaC2’s control domains in May 2025. The FBI had identified at least 1.7 million instances of LummaC2 being used to steal information like this. Microsoft took action against about 2,300 more domains at the same time. The trick outlived that takedown. Microsoft’s ClickFix analysis came out three months later.

It can also be the first step toward ransomware. CISA’s #StopRansomware advisory on Interlock (July 22, 2025) lists ClickFix fake CAPTCHAs and fake browser updates as ways that group gets in, followed by remote access tools, credential stealers, and keyloggers. Fake updates work the same way; see our guide to SocGholish fake browser updates. For more on what stolen credentials turn into, read our infostealer malware guide.

How do I block ClickFix attacks at my business?

Block it in layers, because each layer misses something. Run EDR that a person monitors. Remove the Run box for standard users through Group Policy. Filter DNS so known bad sites don’t load. Put phishing-resistant MFA on email. Then train staff on the one rule that beats every version of this trick.

EDR, watched by a person. Endpoint detection and response watches behavior, like a Run box launching PowerShell that reaches out to the internet. CISA’s Interlock advisory recommends “robust” EDR. Our EDR vs antivirus guide explains the difference, and why an alert nobody reads protects nobody.

Take Win+R away from people who don’t need it. Microsoft’s own mitigation is a Group Policy setting: User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu. Microsoft says it disables the Win+R key and the Run option. Your front desk and closers don’t need it. It won’t stop the PowerShell or Terminal versions, so Microsoft also recommends application control to limit which built-in tools standard users can launch, and PowerShell logging.

Filter what loads. CISA recommends DNS filtering. Many ClickFix pages sit on hacked sites or behind malicious ads, and a filter that blocks known bad domains stops some of them before the page appears.

Protect the accounts, not just the PC. CISA’s LummaC2 advisory recommends phishing-resistant MFA. It makes a stolen password less useful. It doesn’t replace resetting passwords and revoking sessions after an infection.

Train one sentence. “No website will ever ask you to press keys on your computer to prove you’re human.” Say it at the next staff meeting. Tell people that reporting a click is never a firing offense, so they call you in two minutes instead of two days.

None of this needs new hardware. It’s settings, monitoring, and a short conversation. If you don’t know whether your machines have any of it, our managed IT and security service page lists the baseline we put on every machine.

Key takeaways

What this looks like when we do it

On the machines we manage, EDR and 24/7 monitoring are part of the security baseline, so a Run box that suddenly launches PowerShell and calls out to the internet shows up as an alert a person looks at. If a machine looks infected, we can isolate it remotely while it’s still powered on, keep the evidence, and walk you through resets and session sign-outs from a clean device. Critical issues get a response in under 15 minutes.

We’ll also go through which staff actually need the Run box and PowerShell, and help you put the Remove Run menu policy and MFA where they fit. The whole stack is on our managed IT security page.

Had someone paste a “verification” command today, or want to make sure the next one goes nowhere? Book a call.