ClickFix and fake CAPTCHA emails: how the paste-a-command trick works

ClickFix doesn't exploit a bug in Windows. It exploits helpfulness. A page says your document won't display or that you need to prove you're human, and it gives you three easy steps to fix it. Those steps run malware, and you're the one who runs it. This guide explains how the emails and pages work, which policies blunt the attack, and what to do if someone has already pasted the command.

What is ClickFix?

Microsoft Threat Intelligence published a detailed analysis in August 2025. It describes ClickFix as a technique that "attempts to trick users into running malicious commands on their devices by taking advantage of their target's tendency to solve minor technical issues." Microsoft says it observed campaigns "targeting thousands of enterprise and end-user devices globally every day" (Microsoft Threat Intelligence).

MITRE ATT&CK added a matching sub-technique in March 2025, User Execution: Malicious Copy and Paste (T1204.004): "An adversary may rely upon a user copying and pasting code in order to gain execution."

The lure takes several forms:

• A fake CAPTCHA ("Verify you are human") styled like a familiar service.
• A fake browser or document error, such as a Word file that "can't be displayed" with a "How to fix" button.
• A fake update or missing plugin message.

How does a ClickFix attack work, step by step?

1. The lure arrives. Microsoft says attackers use "phishing emails, malvertisements, or compromised websites to lead unsuspecting users to a visual lure."
2. The user clicks a button. "Clicking the button copied the malicious code on the user's clipboard in the background." The page uses the browser's clipboard API to do this without showing anything.
3. The page gives instructions. Typically: press Windows+R, press Ctrl+V, press Enter. The FTC describes exactly this sequence in its June 2026 alert. Some variants use Windows Terminal or PowerShell instead of the Run box.
4. The command runs. It usually calls a built-in Windows program, such as PowerShell or mshta, to download and start the real payload.
5. The payload installs. Microsoft lists information stealers such as Lumma Stealer, loaders and remote access tools among the payloads it has seen.

Because a person starts the command, Microsoft notes a ClickFix campaign "could get past conventional and automated security solutions." Nothing malicious is attached to the email, and the dangerous text only reaches the device through the user's own clipboard.

How are ClickFix lures delivered by email?

Email is one of three main delivery routes, alongside malicious ads and hacked websites. Examples from Microsoft's report:

The email itself is often bland: an invoice, a statement, a shared document or a hosting bill. The trick happens one or two clicks later.

Microsoft's Q1 2026 email threat report says "threat actors use CAPTCHA pages to delay detection and increase user interaction," and that "fake CAPTCHAs are used in ClickFix attacks to trick users into copying and executing malicious commands." A CAPTCHA in front of a page also stops many automated scanners from seeing what's behind it.

If the lure arrives as an attachment, our guides to HTML attachment phishing and PDF phishing attachments cover how to hold those files before delivery.

How do you spot a fake CAPTCHA?

One rule covers almost every case: a web page should never ask you to open Run, Terminal or PowerShell and paste something. The FTC says it directly: "Real CAPTCHAs won't ask you to run commands on your device."

Other warning signs:

• The "verification" asks for keyboard shortcuts rather than clicks.
• The page says a document or site "can't display" and offers a manual fix.
• You arrived from an unexpected email, ad or search result.
• A Mac user sees Windows instructions, or the reverse. Microsoft documented a campaign from late May 2025 delivering Atomic macOS Stealer in which Mac users were shown Windows instructions while the clipboard held a macOS command.

Which defenses work against ClickFix?

ClickFix relies on a person, so the defense is part training and part removing the tools the person is told to use.

Restrict the Run dialog for staff who don't need it

Microsoft's first hardening recommendation is to "Disable the Run dialog box (Win + R) key and remove the Run option from the Start Menu," using Group Policy where the feature isn't needed.

The policy is Remove Run menu from Start Menu, under Administrative Templates > Start Menu and Taskbar (Microsoft lists it for both User and Computer Configuration; Intune exposes it as ADMX_StartMenu/NoRun). Microsoft's policy reference says it removes Run from the Start menu and New Task (Run) from Task Manager, and stops the Windows key + R shortcut from opening the Run box. It also says the setting "doesn't prevent users from using other methods to run programs," so treat it as one layer.

Make pasting commands harder elsewhere

Microsoft's other recommendations from its ClickFix analysis:

1. Windows Terminal: "Configure Windows Terminal access and settings to warn users when the text they're pasting contains multiple lines."
2. App Control for Business: "Create an App Control policy that prohibits the launch of native Windows binaries from Run."
3. PowerShell: turn on script block logging, and use execution policies such as AllSigned or RemoteSigned.
4. Attack surface reduction rules in Defender for Endpoint, including blocking execution of potentially obfuscated scripts and blocking JavaScript or VBScript from launching downloaded executable content.
5. Network and web protection, a browser with SmartScreen, and cloud-delivered protection.

Smaller businesses without Intune or Group Policy can still remove local admin rights from everyday accounts and keep endpoint protection updated. Neither stops ClickFix alone, but both limit what a pasted command can do.

Filter the email that starts it

Gateway and mailbox filtering can't see the command, but they can stop many of the emails: link checks on known bad sites, quarantine for HTML attachments, and impersonation checks on fake invoices and government notices. Microsoft recommends Safe Links, Safe Attachments and zero-hour auto purge for Defender for Office 365 customers. See Safe Links and Safe Attachments for the settings.

Train for the specific move

Generic "don't click links" training doesn't cover this. Show staff a screenshot of a ClickFix page and teach the one rule above. Microsoft recommends teaching users to recognize social engineering and to be aware of what they copy and paste. Add it to your security awareness training.

What should you do if someone ran the command?

Act quickly. Payloads often steal saved browser passwords and session cookies within minutes.

For the person who ran it

1. Disconnect the device from Wi-Fi or unplug the network cable. The FTC's first step is to disconnect from the internet to stop scammers reaching your accounts.
2. Tell IT immediately, and say exactly what you pasted and where it came from.
3. Don't sign in to anything else on that device.
4. From a different, clean device, change your passwords, starting with email, banking and any password manager. The FTC advises changing passwords and turning on two-factor authentication from a different device.

For IT

1. Isolate the device in your endpoint tool if you have one.
2. Check what ran. Microsoft says commands typed into the Run dialog leave traces in the RunMRU registry key, and recommends reviewing it for PowerShell, mshta, rundll32, curl and similar programs, encoded commands, and fake CAPTCHA text. It notes no entry is created if the process failed to run.
3. Assume credentials and sessions are stolen. Reset the user's passwords, revoke active sign-in sessions and review MFA methods. Our guide to signs an email account is compromised lists what to check in the mailbox.
4. Reimage the device if you can't be confident it's clean.
5. Find the email. Search for the same message across all mailboxes and remove it. If someone clicked a link but didn't paste anything, follow what to do after clicking a phishing link.
6. Report it. Forward the original email to your security provider and report the phishing so others can block the page.

Next steps

• Decide which staff need the Run dialog, and apply Remove Run menu from Start Menu to everyone else.
• Send staff a one-line rule this week: never paste a command a web page gives you.
• Quarantine HTML attachments and check your link protection settings.
• Check a suspicious message's real sender and route with the Email Header Analyzer.
• iBlockSpam filters phishing at the MX level and includes attachment-type filters, so lures like HTML files can be held in quarantine before they reach anyone. See how it works.

Browse our other phishing and threat guides.