A CAPTCHA or “human verification” page should not ask you to open Windows Run, Terminal, or PowerShell and paste or run a command. That is the key warning in Microsoft’s reporting on ClickFix, a social-engineering technique that tricks people into executing attacker-supplied commands on their own devices. The command—not the CAPTCHA—is the danger.
What is a ClickFix attack?
ClickFix is a social-engineering technique, not a way for a CAPTCHA to defeat security checks on its own. An attacker presents a fake verification screen or technical-fix prompt and persuades a person to copy, paste, and run a command. Microsoft says the prompt may direct a user to Windows Run, Windows Terminal, or PowerShell. Because the person performs the execution step, the technique can help a campaign get past conventional automated defenses, though it does not guarantee success.
As an Amazon Associate I earn from qualifying purchases.
Ordinary CAPTCHA pages are not inherently dangerous. The red flag is a page that asks you to launch an operating-system command interface and run code to prove you are human or fix a problem. Microsoft’s overview describes the technique and its observed campaigns in “Think before you Click(Fix)”.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How does the lure reach a victim?
- A route to the page: A campaign may start with a phishing email, a malicious advertisement, or a compromised website. The page can imitate a familiar brand or service.
- A convincing prompt: The page displays a fake CAPTCHA, human-verification screen, or technical warning and gives instructions to copy a command.
- Execution by the user: The victim opens Run, Terminal, or PowerShell, pastes the supplied text, and executes it.
- Payload delivery: The command may download or launch additional malicious code. Microsoft has observed information stealers, remote-access tools, loaders, and rootkits, including cases where payloads ran in memory or were injected into legitimate processes. That means looking only for a newly downloaded EXE may miss relevant activity.
What can happen if the command runs?
The outcome depends on the campaign and its payload. Microsoft has reported ClickFix being used to deliver information stealers, remote-access tools such as Xworm and AsyncRAT, loaders, and rootkits. These are examples from observed activity, not a claim that every ClickFix page installs the same malware or causes the same harm.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In one Microsoft case study, a Lampion campaign identified in May 2025 targeted organizations in Portugal’s government, finance, and transportation sectors. The described chain began with a phishing ZIP containing an HTML file, which redirected to a fake Portuguese tax-authority site. The lure prompted PowerShell execution; the command downloaded obfuscated scripts that established later execution. This is a specific campaign example, not a template for every ClickFix attack.
Microsoft Defender Experts said they observed “thousands of devices” affected per month in early 2025. Microsoft defined an affected device for this observation as one where a user executed the ClickFix command, even though an EDR solution was enabled. It is a Microsoft observation from that period, not a global prevalence estimate or a current monthly rate.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How have the lures changed?
Microsoft’s 2026 reporting shows that ClickFix-style prompts can move beyond the familiar Windows Run dialog. The campaigns below are distinct examples; their techniques and reported outcomes should not be generalized to every attack.
| Variant | Microsoft’s reported activity | What to take from it |
|---|---|---|
| CrashFix | Microsoft Defender Experts said they identified the evolution in January 2026. In a report published February 5, Microsoft described a malicious browser extension that deliberately disrupted the browser before displaying a fake CrashFix security warning. The chain used Windows finger.exe and obfuscated PowerShell, with further payload delivery selective to domain-joined systems. Microsoft’s CrashFix analysis. |
A browser problem or warning can be part of the lure; a prompt to run a command is still the critical warning sign. |
| TerminalFix | In a report published August 28, 2026, Microsoft described compromised sites displaying fake Cloudflare CAPTCHA overlays that instructed users to paste a malicious PowerShell command into Windows Terminal or PowerShell. The analyzed chain included DLL sideloading, extraction of payloads from PNG files using steganography, Active Directory reconnaissance, persistence, and a Python-based reverse-tunnel implant. Microsoft said it did not observe the later hands-on-keyboard actions described as possible follow-on activity. Microsoft’s TerminalFix analysis. | Do not treat the appearance of Cloudflare branding as proof a command is safe. The report did not establish ransomware or data theft as observed outcomes of this specific campaign. |
What should you do if a page asks you to run a command?
If you have not run it
- Do not paste or execute the command, even if the page imitates a familiar service or says the step is required to continue.
- Close the page. If it appeared after following a link in an email or message, avoid using that link again and report it through your organization’s security process if the device is managed.
- Use a known, trusted route to reach the service instead of relying on the suspicious page’s instructions.
If you already ran it
- On a work or school device: Contact your IT or security team promptly and tell them what you did, when it happened, and which command interface you used. Follow their instructions rather than trying to clean up the device yourself.
- On a personal device: Stop using the suspicious page and seek help from a trusted support professional. Do not assume that running a scan alone proves the device is clean; some observed campaigns used in-memory execution or legitimate system tools.
How can organizations reduce ClickFix risk?
Microsoft recommends layered controls because the lure can arrive through several routes and the user may be the one to launch the command. These are Microsoft’s recommendations and described capabilities, not an independent ranking of security products.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reduce the chance that users reach a malicious lure
- Train users to recognize social-engineering prompts and to check what they copy and paste. Make clear that a CAPTCHA or human-verification step should not require running an operating-system command.
- Maintain email filtering against spoofing, spam, and malicious messages, and use safe-attachment policies to limit exposure through email.
- Consider enterprise-managed browsers, and enable network and web protection. Microsoft says network protection can block malicious domains earlier in an attack chain.
- Use browsers that support Microsoft Defender SmartScreen and enable cloud-delivered protection.
Improve detection and response
- Enable PowerShell script-block logging so investigators have more visibility into script activity.
- Use endpoint and email-layer detections and investigation workflows appropriate to the organization’s environment. Microsoft describes Defender XDR detections across those layers.
- For CrashFix specifically, Microsoft recommends cloud-delivered protection and EDR in block mode. That guidance relates to the reported variant; it is not a guarantee that any single setting prevents every ClickFix campaign.
When evaluating enterprise protection, compare coverage at the email, browser, endpoint, and network stages; detection of suspicious command execution and malicious destinations; investigation and response workflows; and fit with existing systems. Microsoft’s reporting supports those as useful evaluation areas but does not rank vendors.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
