A verification screen appears while you are reading a page. It looks like the Cloudflare or Google checks you clear all the time. Something has supposedly gone wrong, so it gives you a workaround: press a couple of keys, paste, hit Enter.
Follow those instructions and you may have just launched malware on your own computer.
There was no suspicious attachment to open. No software vulnerability had to be exploited. The browser did not need to break out of its sandbox. The attacker simply convinced you to run the command yourself.
The technique is called ClickFix, and it has spread remarkably fast.
Microsoft's 2025 Digital Defense Report found that ClickFix accounted for 47 percent of the initial-access attacks seen in Microsoft Defender Experts notifications over the previous year, ahead of phishing at 35 percent. ESET recorded a 517 percent increase in ClickFix detections between the second half of 2024 and the first half of 2025, followed by another 108 percent increase between the second half of 2025 and the first half of 2026.
In June 2025, the Federal Trade Commission issued a consumer warning about fake CAPTCHA scams, and MITRE ATT&CK now tracks the technique directly under T1204.004, Malicious Copy and Paste.
For small and mid-sized businesses, one detail in Microsoft's research is especially important. In early 2025, Defender Experts was seeing thousands of devices every month where users had executed a ClickFix command even though an endpoint detection and response product was already enabled. EDR can detect and stop parts of these attacks, but ClickFix is deliberately built to get the user farther into the attack chain before those defenses have much to work with.
How it works
The mechanics are surprisingly simple.
A victim reaches the lure through a phishing email, a malicious ad, a poisoned search result, or a legitimate website that has been compromised. Attackers have repeatedly used real websites as the delivery point, including compromised WordPress sites. The page may load normally before redirecting to what looks like a routine verification screen.
Early ClickFix campaigns used fake browser errors, broken documents, or missing plugins. Fake CAPTCHAs turned out to be much better.
When the victim clicks the verification button, JavaScript on the page copies a command to the clipboard. Nothing obvious appears on screen. The command itself may be heavily obfuscated and often includes harmless-looking text such as a fake "reCAPTCHA Verification ID" to make it less suspicious if someone sees it later.
The page then gives instructions that look almost trivial:
- Press Windows + R.
- Press Ctrl + V.
- Press Enter.
Most people rarely use the Windows Run dialog, which is part of the trick. They know how to follow the instructions, but not necessarily what the Run dialog is capable of doing.
The pasted command executes with the user's existing privileges. It will often invoke PowerShell, mshta, or another legitimate Windows component and use it to contact attacker-controlled infrastructure. From there it can retrieve scripts, loaders, or malware. Some ClickFix chains make heavy use of memory-resident or "fileless" techniques; others still create scripts, archives, installers, or other files along the way.
ClickFix is not invisible to endpoint security, and modern EDR products can catch suspicious command lines, PowerShell activity, malicious network connections, and later-stage payloads. But the attacker has avoided one of the easiest things to detect: a user downloading and opening an obviously malicious executable.
The macOS versions use the same basic idea. In one campaign analyzed by Microsoft, the command prompted the victim for their Mac password, validated it, downloaded Atomic macOS Stealer, and used sudo xattr -c to remove its quarantine attribute before launching it.
There is one useful reassurance here: seeing a fake CAPTCHA does not infect your computer.
Neither does having a malicious command copied to your clipboard. The attack succeeds when you paste that command into Run, PowerShell, Terminal, File Explorer, or another system tool and execute it.
What it installs
ClickFix is a delivery method, not a malware family. Whoever is running the campaign decides what arrives next.
Infostealers have been particularly common. Microsoft's ClickFix research includes campaigns delivering Lumma Stealer and Atomic macOS Stealer. Other campaigns have delivered remote-access tools and RATs such as NetSupport and Remcos, malware loaders, ransomware, and post-exploitation tools.
One campaign Microsoft tracked in June 2025 impersonated the Social Security Administration and installed ScreenConnect, a legitimate remote-management product that could hand the attacker remote control of the victim's machine while looking far less exotic than custom malware.
For an infostealer, the theft can happen quickly. Browser cookies and active sessions are especially valuable: a stolen live Microsoft 365 or Google Workspace session can sometimes give an attacker access without the password or a fresh MFA challenge.
Then there is everything else sitting on a typical business computer: saved passwords, banking credentials, cloud credentials, API keys, SSH keys, developer tokens, customer information, and access to whatever internal systems that employee can reach. On an administrator or developer workstation, that is a very large blast radius.
ClickFix has also become cheap to buy rather than build. Microsoft has observed ClickFix builders advertised on criminal forums since late 2024, complete with CAPTCHA and Cloudflare templates, multiple languages, command generation, persistence features, and anti-analysis options. Subscription prices ranged from roughly $200 to $1,500 per month, with individual components selling separately for a few hundred dollars. That kind of commoditization is one reason the technique shows up in so many otherwise unrelated campaigns.
It is already moving beyond the CAPTCHA
The fake CAPTCHA is just the wrapper. The important part is convincing someone to move attacker-controlled text from the browser into a place where the operating system will execute it.
Attackers have already found other ways to do that.
FileFix moves the pasted command from the Windows Run dialog to the File Explorer address bar. That makes simply disabling Win + R an incomplete defense.
ConsentFix takes the idea in a different direction. Rather than installing malware on the endpoint, it combines ClickFix-style social engineering with Microsoft's legitimate OAuth authorization process. Victims can be tricked into handing over an authorization code that allows an attacker to obtain account access without stealing the password or asking the victim to complete a normal MFA prompt.
In 2026, researchers also documented CrashFix, where a malicious browser extension deliberately caused browser problems and then offered the victim instructions to "repair" them using the same familiar Run-and-paste sequence. ESET has separately tracked ClickFix lures disguised as AI troubleshooting and automated-fix pages.
Trying to teach employees what one particular fake CAPTCHA looks like will not age well. Teach the behavior instead.
How to defend against it
For users, there is a very simple rule:
A CAPTCHA should never ask you to leave the browser and run a command.
If a verification screen tells you to open Run, PowerShell, Command Prompt, Terminal, File Explorer, or another system utility and paste something into it, close the page.
That rule catches the classic ClickFix attack as well as most of its variants. The FTC gives essentially the same advice: real CAPTCHAs do not ask you to run commands on your device.
Administrators have several additional options.
PowerShell script block logging can provide visibility into the obfuscated and encoded commands ClickFix commonly uses. Organizations that do not need the Run dialog can disable it through Group Policy. Application-control policies can also restrict native Windows binaries from being launched through Run, and Windows Terminal can be configured to warn users about suspicious multi-line pastes.
If you suspect someone already followed the instructions, the Windows RunMRU registry key is worth checking early. Windows records commands entered through the Run dialog there, and Microsoft specifically recommends hunting for entries involving tools such as PowerShell, mshta, rundll32, curl, and wscript.
But hardening the endpoint is only part of the answer.
Microsoft's own ClickFix research is a good demonstration of why. Its Defender Experts team was still seeing users execute ClickFix commands on thousands of EDR-protected devices every month. Microsoft responded in part by extracting the malicious infrastructure from those commands and blocking newly created domains through network protection. If the command cannot reach the first-stage server, the rest of the attack has nowhere to go.
Stopping the malicious page before someone ever reaches Win + R is better still.
Where Blue Lantern fits
ClickFix is a particularly good example of the problem Blue Lantern was built around.
A small business can have antivirus and endpoint protection installed and still have an employee staring at a convincing fake CAPTCHA with no idea that the next three keystrokes matter. There may be no malicious attachment to scan and, until the command is executed, very little activity on the endpoint to investigate. So we go after the attack earlier.
When Blue Lantern analyzes a link, we open the site inside our sandbox and let the page behave as it would for a real visitor. If the page serves a ClickFix lure, we can see it. More importantly, we capture what the site tries to place on the clipboard and analyze the command itself.
That means the result is not just "this site is dangerous." We can show what it tried to make the user run.
If the command reaches out to another server, downloads a script, launches PowerShell, or attempts to retrieve malware, those are observable behaviors we can report instead of collapsing everything into an unexplained risk score.
With Blue Lantern's browser protection enabled, a user who reaches a detected ClickFix page can be warned before following the instructions. The administrator on the account is alerted as well, with additional notifications configurable for anyone else who needs them.
The important part is the timing. By the time an infostealer is running, the security problem has become an incident. Credentials may already be leaving the machine.
If you catch the fake CAPTCHA and the clipboard command instead, it is still just a bad webpage.
And you can close the tab.
Sources: Microsoft Digital Defense Report 2025; Microsoft Threat Intelligence and Microsoft Defender Experts, "Think before you Click(Fix): Analyzing the ClickFix social engineering technique"; ESET Threat Reports H1 2025 and H1 2026; Federal Trade Commission, "How to spot a CAPTCHA scam"; MITRE ATT&CK T1204.004; Check Point Research on FileFix; Push Security research on ConsentFix.