ClickFix turns fake CAPTCHAs into malware
Compromised sites are telling visitors to paste a supposed verification command into Windows or macOS terminals, turning a familiar anti-bot ritual into user-authorized malware execution.
The 60-second version
ClickFix uses a fake CAPTCHA to persuade a visitor to paste and execute an attacker-controlled command outside the browser.
Key points
- The unmistakable warning sign is a page asking for Run, PowerShell, Windows Terminal, or macOS Terminal.
- Microsoft documented a Windows TerminalFix chain with DLL sideloading, persistence, domain reconnaissance, and a reverse tunnel.
- Independent reporting shows the broader ClickFix technique reaching both PCs and Macs, but payloads differ by campaign.
- If a command was already run, isolate the device, begin incident response, and rotate accessible credentials from a clean device.
Verdict. Treat any CAPTCHA that leaves the browser and asks you to paste a command as malicious; the simple boundary rule is more reliable than judging how convincing the page looks.
Warning signA CAPTCHA should stay inside the browser
If a verification page asks you to open Run, PowerShell, Windows Terminal, or macOS Terminal, paste a command, and press Enter, stop. That is not a normal CAPTCHA flow; it is the defining ClickFix lure.
The attacker may have compromised a site people already trust. A convincing overlay then places a command on the clipboard and turns the victim into the final execution step. The operating system sees a user launching a legitimate tool, not a browser silently breaking out of its sandbox.
Real web verification does not need you to run a command outside the browser.
Attack flowHow one click becomes code execution
| 1. Lure | A compromised or malicious site displays a verification overlay that imitates a familiar CAPTCHA. |
|---|---|
| 2. Clipboard | Interacting with the page copies an attacker-selected command and reveals instructions for opening a command interface. |
| 3. Execution | The visitor pastes and runs the command, giving it the user's own permissions. |
| 4. Payload | The command downloads and launches later stages; the exact malware differs by campaign and operating system. |
The trick works because modern web use already trains people to complete intrusive, unfamiliar steps. Repeated consent boxes and verification rituals can make one more set of instructions feel routine. The defense must account for that design fatigue rather than blaming the person who was deceived.
Case studyWhat Microsoft observed in TerminalFix
Microsoft Threat Intelligence analyzed a Windows campaign it calls TerminalFix. Its pasted PowerShell command downloaded an archive containing a legitimate signed Windows executable beside a malicious DLL. Starting the trusted executable caused it to load the attacker's library from the same directory, a technique known as DLL sideloading.
- Later code extracted payloads concealed inside PNG pixel data.
- Registry and scheduled-task entries restored execution after restart and at intervals.
- The malware enumerated domain relationships, administrators, computers, users, and selected servers.
- A Python-based reverse tunnel provided encrypted proxy-style access through the infected host.
That tunnel could make the host a pivot into an organization's network. Microsoft says defenders should investigate lateral movement and credential exposure, but it did not observe the downstream privilege escalation, data theft, security-control disabling, or ransomware actions described as typical possibilities.
ScopeA technique, not one universal payload
ClickFix names the persuasion pattern. Different operators use different pages, commands, infrastructure, and malware. Ars Technica reports variants targeting Windows and macOS, while Microsoft's detailed chain is a Windows enterprise case. A Mac lure does not therefore imply the same DLL or Active Directory behavior.
ResponseWhat users and defenders should do
- Before execution: close any page that asks you to paste a command into an operating-system tool. Do not try to clean up or inspect an unknown command by running it.
- After execution: stop sensitive activity, follow the incident process, isolate the device, and report exactly what was pasted and where.
- Credential recovery: assume credentials accessible from the host may be exposed; rotate them from a known-clean device, prioritizing privileged accounts.
- Enterprise hardening: restrict command tools where practical, enable logging and application control, monitor unusual executable paths, and layer browser, endpoint, and network protection.
The durable habit is a boundary check: a website may ask you to click inside the browser, but it should not ask you to become its command runner.