Fake CAPTCHA ClickFix Scam on Windows: How Clipboard Commands Steal Your PC

A real-world encounter detailed by MakeUseOf Senior Editor Ben Stegner highlights exactly how this trap springs in the wild, and security documentation from Microsoft Threat Intelligence and Cloudflare explains why these fake verification prompts have become a major headache for home users and enterprise IT administrators alike. When a website asks you to prove your humanity by opening a Windows system tool and hitting paste, you are not passing a security check—you are handing the keys of your PC to an attacker.

Anatomy of a Modern Fake-CAPTCHA Lure​

In Stegner’s account for MakeUseOf, the attack began not with a sketchy download site, but with a targeted email landing in his work inbox. The message claimed that someone had published a news article about him containing his personal contact information—a classic fear-and-curiosity hook reminiscent of the old "is this you in this video?" social media scams.

Even without traditional spelling and grammar mistakes, three red flags stood out immediately in the email Stegner received:

• The psychological hook: It relied on urgency and personal exposure to push the recipient into visiting an unfamiliar site.
• Mismatched sender identity: The display name did not match the sending address, which came from a .cl (Chile) domain belonging to an actual Chilean catering company that had no logical reason to contact him.
• Filter evasion formatting: Rather than linking the destination website normally, the message inserted an intentional space before .com—a deliberate formatting trick likely designed to stop email security scanners like Gmail from automatically parsing and blocking the malicious URL.

When Stegner investigated the destination domain inside a virtual machine sandbox and checked its history on the Internet Archive’s Wayback Machine, he found an erratic paper trail. Across years of snapshots, the domain had shifted between parked pages and low-quality pseudo-news layouts, including an older iteration featuring blurry media logos and a navigation bar bizarrely mixing top news with "Poems About Life." While it remains unconfirmed whether the site was a low-grade domain that was compromised earlier in the year or a deceptive property rotated to fool web crawlers, a direct visit bypassed the site content entirely and went straight for the jugular: a counterfeit Cloudflare human verification prompt.

Section Summary: Modern phishing lures frequently skip hyperlinked URLs and obvious typos, using broken domain text and spoofed or compromised sender domains to steer victims toward compromised or purpose-built trap websites.

How the "ClickFix" Clipboard Trap Works on Windows​

When visiting the dubious URL directly, Stegner was greeted by a prompt impersonating a Cloudflare verification screen asking him to click an "I'm not a robot" button. The moment that button was clicked, a pop-up instructed him to open the Windows Command Prompt, press Ctrl + V to paste, and click "Verify" to finish. Behind the scenes, clicking the web button silently loaded an obfuscated command onto his Windows clipboard.

In the cybersecurity world, Microsoft Threat Intelligence tracks this exact social engineering tactic as ClickFix. First observed by Microsoft in email campaigns between March and June 2024—initially via HTML attachments sent by a threat group tracked as Storm-1607—ClickFix has evolved into a massive threat targeting thousands of enterprise and end-user devices globally every day.

Here is why the technique is so insidious on Windows:

1. Weaponizing the Clipboard API: When you click the fake verification checkbox on the webpage, underlying JavaScript—often using the browser's navigator.clipboard.writeText() method (or the older, deprecated document.execCommand())—automatically injects a malicious command string straight into your operating system's clipboard.
2. Abusing Trusted Windows Interfaces: Instead of trying to force an automated browser exploit, the webpage gives you step-by-step instructions to open the Windows Run dialog (Win + R), Command Prompt, Windows Terminal, or Windows PowerShell, paste the clipboard contents (Ctrl + V), and execute them.
3. Obfuscation and Misdirection: When Stegner pasted his clipboard contents into Notepad rather than Command Prompt, he found an obfuscated script hiding its true function behind variables and filler text. Microsoft notes that many ClickFix variants append benign-looking cover text—such as "I am not a robot | Verification Hash 1234" or "Microsoft Defender Services Secure Access"—while using Base64 encoding, caret (^) escape characters, or concatenated strings so the actual payload scrolls out of view or looks like harmless gibberish.
4. Living Off the Land: Why ask the user to do the pasting? Because human-initiated execution helps attackers sidestep conventional automated browser and download blocks. Once pasted and run, the command typically calls native Windows utilities—known as Living-off-the-Land Binaries (LOLBins)—such as powershell.exe (frequently via Invoke-WebRequest/iwr, Invoke-RestMethod/irm, or Invoke-Expression/iex), mshta.exe, rundll32.exe, wscript.exe, curl, or wget.

According to Microsoft Threat Intelligence, payloads deployed via ClickFix campaigns include prolific information stealers like Lumma Stealer and Lampion, loaders like DarkGate, Latrodectus, and MintsLoader, abused remote management tools like ScreenConnect, and even in-memory rootkits like a modified r77 injected into native processes (msbuild.exe, regasm.exe, or powershell.exe). On macOS, similar lures have even been adapted to deliver the Atomic macOS Stealer (AMOS). Threat actors buy pre-packaged "ClickFix builders" on underground forums for anywhere between $200 and $1,500 per month, complete with ready-made Cloudflare, Google reCAPTCHA, and Discord templates.

Section Summary: ClickFix attacks do not infect your PC merely when you click the fake webpage button; the compromise happens when you follow the on-screen instructions to paste and execute the hijacked clipboard contents inside a Windows command interface.

Real Verification vs. Malicious Impersonation​

How can you be 100% certain a verification prompt is lying to you? By understanding how real browser challenges actually work.

According to Cloudflare’s official developer documentation for Turnstile—its widely used CAPTCHA alternative—challenges run entirely as a client-side script inside your web browser. Whether a site uses an invisible background check, a non-interactive widget, or a managed checkbox that asks you to click a box, the entire verification process stays strictly within the browser tab.

As a hard rule of thumb: No legitimate website, CDN, or human verification service will ever ask you to open a terminal, launch the Windows Run dialog, or paste text into your operating system to prove you are human.
Section Summary: Legitimate human verification stays strictly inside the browser. Any prompt asking you to touch Win + R, Command Prompt, or PowerShell is an immediate social engineering attack.

Practical Guidance for Windows Users and IT Admins​

In Stegner’s case, after inspecting the script safely in Notepad, he ran a WHOIS lookup, reported the domain to its listed registrar (GoDaddy)—after which the site soon began returning an error—and notified the Chilean catering company whose domain had been used in the sender address.

What should you do if you or someone in your organization encounters one of these traps?

For Everyday Windows Users​

• If you clicked the fake CAPTCHA button but did NOT paste and press Enter: Take a breath. Clicking the button on the webpage copies the malicious text to your clipboard, which by itself does not execute the command. Close the browser tab immediately, and clear your clipboard by copying a harmless word from Notepad or clearing your clipboard history (Win + V in Windows 10 and Windows 11).
• If you want to inspect suspicious clipboard text safely: Never paste unknown clipboard contents into the Run box, Terminal, or File Explorer address bar. Even pasting into Windows Terminal can be risky if the string contains newline characters that automatically trigger execution.
• If you pasted and ran the command: Treat the PC as compromised immediately. Disconnect the computer from Wi-Fi and Ethernet, notify your IT security team if it is a work device, run a full offline scan using Microsoft Defender, and change your passwords and session tokens from a completely separate, clean device.

For Enterprise IT Administrators​

Microsoft Defender Experts noted that in early 2025, thousands of devices per month were still affected by user-executed ClickFix commands even in environments where Endpoint Detection and Response (EDR) was present, because the user manually initiated the trusted binary. To lock down Windows environments, Microsoft recommends a layered defense:

• Harden the Windows Run Dialog: If standard users do not need the Win + R dialog for daily tasks, use Group Policy to disable the Run dialog or restrict which binaries can be launched from it.
• Audit the RunMRU Registry Key: When commands are executed via the Windows Run dialog (explorer.exe), Windows records them in the RunMRU registry key. Security teams can hunt for entries referencing powershell, mshta, rundll32, wscript, curl, wget, or suspicious cmdlets like iwr, irm, and iex.
• Enable PowerShell Protections: Turn on PowerShell Script Block Logging to capture de-obfuscated command execution in event logs, enforce AllSigned or RemoteSigned execution policies where practical, and ensure the Antimalware Scan Interface (AMSI) and Microsoft Defender network protection are active to block connections to newly spun-up command-and-control (C2) domains.
• Tighten Email and Browser Controls: Configure Microsoft Defender for Office 365 to recheck links on click and scan HTML attachments, and use enterprise-managed browsers with SmartScreen enabled.

Have you or your users run into a fake Cloudflare or reCAPTCHA prompt asking for Win + R in the wild? Share what lures you are seeing in our security discussions on WindowsForum.com—just leave the clipboard scripts out of the terminal!