# ClickFix Fake CAPTCHA Malware: What to Do After "Verify You Are Human" Asks for Win+R URL: https://limehawk.io/reports/clickfix-fake-captcha-malware Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min A ClickFix page fakes a CAPTCHA, copies a command, and says to paste it into Win+R. If someone ran it, unplug the PC, call IT, and reset passwords elsewhere. > **TL;DR** ClickFix is a fake "Verify you are human" page. Clicking the checkbox quietly copies a command to your clipboard, then the page tells you to press Win+R, paste, and hit Enter. That runs the attacker's command on your own PC. CISA and the FBI tie it to the LummaC2 infostealer, and Microsoft has seen it drop remote access tools too. If an employee did it: unplug the PC from the network but leave it on, call IT, and change passwords from a different device. To stop the next one, run EDR that someone actually watches, take the Run box away from standard users, and teach one rule: a real CAPTCHA never asks you to type anything into Windows. - LummaC2 thefts FBI identified: 1.7 million ## What should I do right now if someone pasted the command? If an employee pressed Win+R, pasted, and hit Enter, treat that PC as infected. Pull the network cable or turn off Wi-Fi, but leave the machine powered on. Don't run the command again, don't wipe the PC, and don't start deleting things. Call IT now. Then change passwords from a different device. In order: 1. **Disconnect it.** Unplug the network cable or switch off Wi-Fi. That cuts the attacker's connection and stops more data leaving. 2. **Leave it on and leave it alone.** A running machine still holds evidence. If you have EDR, your IT team can investigate and isolate it remotely. Wiping it now destroys the record of what ran. 3. **Take a phone photo** of the fake page and the instructions if they're still on screen. Note the time and the website. 4. **Call IT.** Tell them exactly what was pasted and when. This is what an [incident response plan](/reports/incident-response-plan-template) is for. 5. **Reset passwords from a clean device.** Start with email, then banking and anything saved in that browser. The usual payload steals saved passwords and more (see below), so have IT also sign the account out of every session, not just change the password. 6. **Warn whoever moves money.** Stolen email logins lead straight to [business email compromise](/reports/business-email-compromise). For the next few weeks, verify every new or changed payment instruction by phone, the way our [wire verification guide](/reports/how-to-verify-wire-instructions) lays out. If the employee clicked the checkbox but never pasted anything, the command was only copied to the clipboard. Close the browser, don't paste, and still tell IT so they can block the site. ## How does the ClickFix "Verify you are human" trick work? ClickFix gets the victim to run the attacker's command for them. The page looks like a normal CAPTCHA. When you tick the box, a script on the page copies a hidden command to your clipboard. Then it shows "verification steps": press Windows+R, press Ctrl+V, press Enter. Those three keys run the command. CISA and the FBI described the same steps in their [May 21, 2025 LummaC2 advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b): a fake CAPTCHA "contains instructions for users to then open the Windows Run window (Windows Button + R) and paste clipboard contents," and pressing Enter starts an encoded PowerShell process. [Microsoft's August 21, 2025 analysis of ClickFix](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) adds three things a business owner should know: - **It's common.** Microsoft says it has seen ClickFix campaigns "targeting thousands of enterprise and end-user devices globally every day." - **The command uses tools already on Windows**, like PowerShell and mshta. Nothing looks like a download, which is why plain antivirus can miss it. - **The script varies.** Some versions ask you to paste into PowerShell or Windows Terminal instead of the Run box, and a June 2025 campaign targeted Mac users. People fall for it because it borrows trust. Everyone has clicked a real "I'm not a robot" box, and the fake one shows up on a hacked legitimate website, a malicious ad, or a link in an email. Nothing about it feels like opening an attachment. ## What does ClickFix malware actually install? Most often it installs an infostealer or a remote access tool. Microsoft lists Lumma Stealer as the most prolific ClickFix payload, plus remote access trojans like Xworm, AsyncRAT, and NetSupport, and loaders that pull down more malware later. According to [CISA's LummaC2 advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b), LummaC2 takes personal information, financial credentials, cryptocurrency wallets, browser extensions, and multifactor authentication details. That's why step 5 above says to reset passwords from another device and kill sessions. On a compromised PC, anything you type next goes to the attacker too. The Justice Department [seized LummaC2's control domains in May 2025](https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation). The FBI had identified at least 1.7 million instances of LummaC2 being used to steal information like this. Microsoft [took action against about 2,300 more domains](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/) at the same time. The trick outlived that takedown. Microsoft's ClickFix analysis came out three months later. It can also be the first step toward ransomware. CISA's [#StopRansomware advisory on Interlock](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a) (July 22, 2025) lists ClickFix fake CAPTCHAs and fake browser updates as ways that group gets in, followed by remote access tools, credential stealers, and keyloggers. Fake updates work the same way; see our guide to [SocGholish fake browser updates](/reports/socgholish-fake-browser-update). For more on what stolen credentials turn into, read our [infostealer malware guide](/reports/infostealer-malware). ## How do I block ClickFix attacks at my business? Block it in layers, because each layer misses something. Run EDR that a person monitors. Remove the Run box for standard users through Group Policy. Filter DNS so known bad sites don't load. Put phishing-resistant MFA on email. Then train staff on the one rule that beats every version of this trick. **EDR, watched by a person.** Endpoint detection and response watches behavior, like a Run box launching PowerShell that reaches out to the internet. CISA's Interlock advisory recommends "robust" EDR. Our [EDR vs antivirus guide](/reports/edr-vs-antivirus) explains the difference, and why an alert nobody reads protects nobody. **Take Win+R away from people who don't need it.** Microsoft's own mitigation is a Group Policy setting: **User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu**. Microsoft says it disables the Win+R key and the Run option. Your front desk and closers don't need it. It won't stop the PowerShell or Terminal versions, so Microsoft also recommends application control to limit which built-in tools standard users can launch, and PowerShell logging. **Filter what loads.** CISA recommends DNS filtering. Many ClickFix pages sit on hacked sites or behind malicious ads, and a filter that blocks known bad domains stops some of them before the page appears. **Protect the accounts, not just the PC.** CISA's LummaC2 advisory recommends [phishing-resistant MFA](/reports/phishing-resistant-mfa). It makes a stolen password less useful. It doesn't replace resetting passwords and revoking sessions after an infection. **Train one sentence.** "No website will ever ask you to press keys on your computer to prove you're human." Say it at the next staff meeting. Tell people that reporting a click is never a firing offense, so they call you in two minutes instead of two days. None of this needs new hardware. It's settings, monitoring, and a short conversation. If you don't know whether your machines have any of it, our [managed IT and security service](/services/managed-it-security) page lists the baseline we put on every machine. ## Key takeaways - No real CAPTCHA asks you to press Win+R, open PowerShell, or paste anything. That instruction is the attack. - If someone pressed Enter, assume it ran. Disconnect the PC, leave it powered on, and call IT before anyone wipes it. - Change passwords from a different, clean device, starting with email and banking, and have IT sign the account out everywhere. - ClickFix usually delivers infostealers like LummaC2 or remote access tools. CISA has also listed it as a way into networks for Interlock ransomware. - Block it in layers: monitored EDR, the Remove Run menu policy for standard users, DNS filtering, phishing-resistant MFA, and a ten-minute training talk. ## What this looks like when we do it On the machines we manage, EDR and 24/7 monitoring are part of the security baseline, so a Run box that suddenly launches PowerShell and calls out to the internet shows up as an alert a person looks at. If a machine looks infected, we can isolate it remotely while it's still powered on, keep the evidence, and walk you through resets and session sign-outs from a clean device. Critical issues get a response in under 15 minutes. We'll also go through which staff actually need the Run box and PowerShell, and help you put the Remove Run menu policy and MFA where they fit. The whole stack is on our [managed IT security page](/services/managed-it-security). Had someone paste a "verification" command today, or want to make sure the next one goes nowhere? Book a call.