A fake CAPTCHA can copy a malicious command to your clipboard and trick you into running it—but the documented Windows attacks required more than clicking the checkbox. The dangerous step was pasting the command into Windows Run and executing it. Treat any website that asks you to open Run, PowerShell, Terminal, or another command tool to prove you are human as a serious warning sign.
How the fake CAPTCHA attack works
The technique is often called ClickFix: a page presents a fake verification prompt, changes the clipboard after a click, then tells the visitor to paste and run what was copied. A familiar “I’m not a robot” message or reCAPTCHA-style logo does not prove that the page is genuine.
As an Amazon Associate I earn from qualifying purchases.
- The lure appears. A visitor encounters a fake verification prompt, sometimes after reaching a compromised site, an advertisement, a search-engine manipulation, or a redirect.
- The page changes the clipboard. In documented cases, clicking the prompt copied a command. A clipboard change does not itself mean that the copied command has run.
- The visitor is told to execute it. The page instructs the person to paste the command into Windows Run or another command interface. In the documented Windows attacks, this user action was the step that launched the next code.
- The command retrieves or starts malicious code. What happens next depends on the campaign: the command may fetch additional scripts or payloads. The specific loaders and malware described in reports are examples, not a universal recipe.
Microsoft described a May 2025 campaign in which injected JavaScript on compromised websites retrieved ClickFix content and displayed a fake “I’m not a robot” prompt. Clicking copied a command; the visitor was then directed to paste and run it through Windows Run. In that campaign, the command used mshta to retrieve and start further code. Microsoft’s campaign analysis is specific to that observed chain; it should not be taken as the command or loader used by every fake CAPTCHA.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What security researchers observed in separate campaigns
| Report | How the lure reached people | Execution and observed payload |
|---|---|---|
| Microsoft, May 2025 | Compromised websites with injected JavaScript presenting ClickFix content. | The prompt copied a command that the visitor was directed to run through Windows Run. The observed command used mshta to retrieve and start further code; Microsoft’s report connects the campaign to Lumma Stealer. |
| Mandiant | A fake CAPTCHA displayed a reCAPTCHA logo and “I’m not a robot.” | Clicking copied a hidden PowerShell command; the visitor was persuaded to paste it into Windows Run. The analyzed command retrieved another script from an attacker-controlled server, leading to a CORNFLAKE.V3 backdoor chain. Investigators also used a related RunMRU entry to identify the activity. Mandiant’s CORNFLAKE.V3 analysis describes this separate case. |
| HP Wolf Security | One campaign used web advertisements, search-engine optimization hijacking, and redirects from compromised websites. | In HP’s example, a copied PowerShell script downloaded a large payload, unpacked software in AppData, and created a Registry Run key for persistence; the payload was Lumma Stealer. Those behaviors describe this variant, not every infection. HP Wolf Security’s campaign report covers the example. |
The reports show why the delivery route, command, and payload should be kept distinct. A fake CAPTCHA is the social-engineering lure; it does not identify which malware, if any, will follow. These sources document Lumma Stealer and a separate CORNFLAKE.V3 chain, not one universal outcome.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if a CAPTCHA tells you to run a command
- Do not paste or execute website-provided text in Windows Run, PowerShell, Terminal, or a similar tool as a verification step or “fix.” A legitimate human check should not require it.
- Close the suspicious page. A click may change the clipboard without executing the copied command, but that does not establish that every page is harmless; the documented execution chain required pasting and running the command.
- If you pasted and executed the command, stop using the affected device for sensitive activity and contact your organization’s security team or trusted incident-response support. The right response depends on the device and what actually ran; these reports do not establish one remediation procedure for every variant.
What organizations can do
For the Lumma-related threat it documented, Microsoft recommends layered defenses including Defender endpoint, network, and web protections; attack-surface-reduction rules; multifactor authentication and phishing-resistant authentication; and SmartScreen. These are recommendations for reducing risk, not a guarantee that an attack will be prevented. Microsoft’s threat guidance provides the campaign context.
HP says that administrators using HP Sure Click Enterprise can disable clipboard sharing, and that Windows Run can be disabled through Group Policy when users do not need it. Those controls apply to the environments described by HP; they are not universal consumer settings. HP’s report discusses these options.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How defenders should interpret investigation clues
Microsoft lists alerts and detections related to suspicious commands in RunMRU, suspicious PowerShell, possible theft of browser information, and FakeCaptcha/ClickFix activity. Mandiant also describes a RunMRU entry as a clue used in its investigation. These are leads for security teams, not proof on their own that a device is infected: Microsoft cautions that some detections can also be triggered by unrelated activity. Microsoft’s alert guidance gives more detail.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
