The ClickFix scam: the fake captcha that can infect your whole company (and how to spot it in 5 seconds)
The ClickFix scam uses a fake captcha.
Imagine an employee visits a normal-looking website to download a document or watch a video. A captcha appears, one of those "verify you are human" ones we all see every day. They follow the instructions… and without knowing it, they have just installed malicious software on the company computer.
This is not a hypothetical. It is a real scam, on the rise, called ClickFix. And it works precisely because it disguises itself as something we all do without thinking.
We explain what it is, how to recognise it and, above all, how to prevent a momentary slip from becoming a serious problem for your business.
What the ClickFix scam is
ClickFix is an attack technique that cybersecurity firms such as Malwarebytes, Rapid7, Trend Micro or SlashNext have been documenting for some time. Its great strength is that it does not fool the computer: it fools the person.
It works like this:
- A screen appears that imitates a real captcha from Cloudflare or Google. It looks identical to the real one.
- Instead of asking for a simple click, it gives you instructions: open a system window on your computer and paste some text (usually into a Windows tool called PowerShell).
- If the victim does it, that text runs a command that installs malware directly into the computer's memory, without downloading any visible file.
That last detail is key. Since no suspicious file is downloaded, many tools and many people see nothing strange. The damage is done before anyone notices.
The most dangerous detail: the website can be legitimate
Here is what makes ClickFix especially treacherous: very often the infected website is completely legitimate.
These are pages of real businesses that have been hacked without their owner knowing. The owner has no idea that their website is serving this trap to visitors. That is why the advice "only visit trusted websites" is not enough: a trusted website can also be compromised.
How to recognise a ClickFix: the real captcha rule
Although the attackers take great care over the design, there is a rule that never fails and that anyone in your company can learn in a minute:
A real captcha or verification NEVER asks you to open anything or paste commands. It only asks for a click (or to tick images).
No exceptions. There is not a single legitimate verification system on the internet that asks you to open a window on your computer or copy and paste text into it.
So the warning sign is immediate. If a "verification" asks you for any of these things, it is an attack:
- Open a system window (Run, PowerShell, Terminal…).
- Press specific key combinations (for example, Windows + R).
- Copy some text and paste it somewhere.
- Follow "some steps" to prove you are human.
A real human is proven with a click. Full stop.
What to do if you come across this screen
If you or someone on your team comes across a supposed verification that asks you to paste commands, the answer is simple:
- Do not follow any instruction. Do not open anything, do not copy anything, do not paste anything.
- Close the tab or the browser straight away.
- Do not go back to that website and notify the person in charge of IT at your company.
- If the command was already run, disconnect the computer from the network (turn off Wi-Fi or unplug the cable) and contact a professional as soon as possible. The sooner you act, the smaller the damage.
The worst mistake is trying to "fix it on your own" or acting as if nothing had happened. In cybersecurity, reaction time is everything.
Why this is a business problem, not just an IT one
It is easy to think this happens "to others" or that an antivirus solves it. The reality is more uncomfortable:
- A single employee is enough. Management does not need to fall for it: anyone with access to a computer can open the door by accident.
- Modern malware looks for money and data. It can steal passwords, access bank accounts, encrypt your files and ask for a ransom, or sneak into your customers' computers.
- The real cost is not the computer. It is the business stoppage, the loss of information, the damage to your reputation and the legal obligations if third-party data is affected.
No program fully protects against an attack designed to fool the person, not the machine. That is why defence combines two things: well-protected and well-configured devices, and a human team that knows how to recognise the trap.
Training and protection: the two halves of the same defence
In a small business or company, security cannot depend on each employee "being careful" by intuition. What is needed is:
- Clear, practical training so the whole team recognises this kind of deception instantly, without jargon.
- Professional protection of devices, configured and maintained by specialists, which reduces the margin for human error to a minimum.
- An action protocol so everyone knows exactly what to do when something looks suspicious.
It is the difference between hoping nothing happens and being truly prepared for when someone tries.
Protect your INVESTMENT before it is too late
The ClickFix scam works because it bets that nobody has stopped to explain to your team how to recognise it. With the right information and protection, that attack no longer stands a chance.
At Bytechip we help freelancers, small businesses and companies protect their devices and prepare their human teams against this kind of threat. If you want your business covered by professionals who know these techniques from the inside, let's talk.
REQUEST A QUOTE