ClickFix Fake CAPTCHA Attacks and the Infostealer Pipeline

Most malware has to sneak past security tools. ClickFix takes a simpler route: it convinces the victim to install it themselves. A web page shows a fake CAPTCHA or a fake error, then gives "simple steps" to fix it: press a couple of keys, paste, and hit Enter. What the user has just pasted is a command that downloads malware.

In less than two years ClickFix has become one of the most common ways attackers get malware onto computers, second only to phishing in some measurements. Its favourite payload is the infostealer, which means a single click on a fake CAPTCHA can end with an employee's saved passwords and session cookies for sale on the dark web. This guide explains how that pipeline works and how to break it.

What Is ClickFix?

ClickFix is a social engineering technique, not a single piece of malware. It shows the user a believable problem, such as "verify you are human", "your browser needs an update" or "this document failed to load", and offers a fix that requires running a command. Because the user runs the command themselves, many of the protections that stop malicious downloads and attachments never get a chance to act.

The technique works on Windows, macOS and Linux. Criminal groups, ransomware affiliates and state-aligned actors have all used it, and the list of malware delivered through it keeps growing: infostealers, remote access trojans, cryptominers and ransomware loaders.

How a ClickFix Attack Works

1. The lure. The victim lands on a page that looks legitimate. Often it is a real small-business website that attackers have compromised, or a page reached through a malicious ad or search result.
2. The fake problem. A CAPTCHA, error message or "verification" box appears and asks the user to click a button such as "Verify" or "Fix".
3. The hidden copy. Clicking the button silently copies a malicious command to the clipboard using JavaScript.
4. The instructions. The page tells the user to open the Windows Run box (Windows key + R), Windows Terminal, or the Mac Terminal, then paste and press Enter.
5. The download. The command, usually an encoded PowerShell or shell command, fetches the next stage from the attacker's server, often without saving an obvious file to disk.
6. The payload. The final stage installs malware, most often an infostealer such as Lumma Stealer on Windows or Atomic Stealer (AMOS) on macOS, which collects saved passwords, cookies, crypto wallets and system details.

How Widespread ClickFix Has Become

ESET's telemetry shows how quickly the technique spread. In the first half of 2025, ClickFix attacks rose by more than 500 percent and made up nearly 8 percent of all attacks ESET blocked, behind only phishing. After a quieter second half of 2025, detections of fake CAPTCHA pages rose again by 108 percent in the first half of 2026, though they stayed below the early-2025 peak.

The targets are global. In ESET's H1 2026 data, Japan accounted for the largest share of detections at 14 percent, followed by Slovakia at 7 percent, with France, Spain and Peru each above 5 percent. ESET also warns that counting fake CAPTCHA pages alone understates the problem, because each stage of an attack may be detected under a different name.

New ClickFix Variants in 2026

Attackers keep changing the lure while the core trick stays the same. The main variants seen so far:

Many ClickFix campaigns also hide their configuration on public blockchains, a technique known as EtherHiding, which makes the infrastructure harder to take down.

From Fake CAPTCHA to Dark Web Market

ClickFix is usually just the first step in a longer criminal supply chain:

The scale of that market is large. KELA tracked 2.86 billion compromised credentials circulating across criminal markets in 2025, and Verizon's 2025 Data Breach Investigations Report found that 54 percent of ransomware victims had domain credentials in stealer log markets before they were attacked. ClickFix is one of the main ways those logs are produced.

Why ClickFix Is a Business Problem

• Personal devices leak corporate logins. An employee who logs into work email or SSO on a home computer can lose those credentials when a family member clicks a fake CAPTCHA.
• Session cookies bypass MFA. Stolen session tokens let attackers reuse a logged-in session without needing the password or a second factor.
• It evades email security. Many ClickFix lures arrive through web browsing, ads or compromised sites, not email attachments.
• It hides in normal tools. PowerShell, Windows Terminal and Terminal are legitimate tools that admins use every day.

How to Detect ClickFix Activity

On your endpoints

• PowerShell, cmd or mshta launched from the Run dialog or Windows Terminal with encoded or obfuscated commands
• Commands that download and run content in one step, such as curl piped into a shell on macOS
• New Microsoft Defender exclusions or disabled protections shortly after a browsing session
• Unexpected browser extensions, especially new ad blockers

On the dark web

• Employee work emails, SSO or VPN logins appearing in stealer logs
• Session cookies for your Microsoft 365, Okta or SaaS tenants in leaked logs
• Access to your organisation advertised by brokers

The endpoint signals tell you an infection may have happened on a managed device. Dark web monitoring tells you when credentials stolen from any device, managed or not, have reached criminal markets. DarkThreat monitors stealer logs, forums and Telegram channels for your domains so you can reset exposed accounts quickly. See DarkThreat plans.

How to Prevent ClickFix Attacks

1. Train people on one clear rule: real websites never ask you to paste commands. Include ClickFix screenshots in security awareness training.
2. Restrict the Run dialog and scripting for regular users through Group Policy or device management where it does not affect their work.
3. Use PowerShell Constrained Language Mode and attack surface reduction rules to block obfuscated scripts and suspicious child processes.
4. Control browser extensions with an allowlist on managed browsers.
5. Protect sessions, not just passwords: use phishing-resistant MFA, token protection and short session lifetimes for sensitive apps.
6. Limit corporate logins on personal devices with conditional access policies.
7. Monitor stealer logs for your domains and reset passwords and revoke sessions as soon as an employee's data appears.

Key Takeaways

• ClickFix tricks users into running malicious commands through fake CAPTCHAs and fake error fixes.
• It surged by more than 500 percent in 2025 and grew again in 2026, with new variants using Windows Terminal, AI platforms and browser extensions.
• Its main payload is infostealers, which feed stolen logins and cookies into dark web markets.
• Those logs are a major source of the access later used in ransomware attacks.
• User awareness, script restrictions, session protection and stealer-log monitoring together break the chain.

Frequently Asked Questions

What does a ClickFix page look like?

Usually a normal-looking CAPTCHA or error box with a "Verify" or "Fix" button, followed by short instructions to press keys like Windows + R or Windows + X, paste, and press Enter.

What should I do if I already ran the command?

Disconnect the device from the network, tell your IT or security team immediately, and from a different, clean device change your passwords and sign out of all sessions for important accounts, especially email, banking and work logins.

Does antivirus stop ClickFix?

Modern endpoint protection catches many ClickFix stages, but because the user runs the command and attackers keep changing their scripts, it does not catch every case. Training and restricting scripting reduce the risk further.

Is ClickFix only a Windows problem?

No. Campaigns target macOS through Terminal commands and Linux as well. Mac users are frequently targeted with Atomic Stealer.

How does dark web monitoring help with ClickFix?

Infections on unmanaged devices are invisible to your security tools. When the stolen data appears in stealer logs, dark web monitoring alerts you so you can reset credentials before attackers use them.

Related Resources

• Infostealer Logs: What They Contain and Why You Need to Monitor Them
• How Infostealer Malware Enables Ransomware: The Attack Kill Chain
• Stolen Session Tokens vs Passwords: New Frontier of Credential Theft
• Building Employee Awareness Programs Around Credential Security
• Qilin Ransomware: Dark Web Activity and Business Risks

Sources

• Help Net Security: ClickFix attacks skyrocketing more than 500% (ESET Threat Report H1 2025)
• ITmedia: ESET Threat Report H1 2026 findings on ClickFix (Japanese)
• The Register: Microsoft spots ClickFix campaign abusing Windows Terminal
• CybelAngel: How ClickFix uses fake CAPTCHAs to compromise users
• CybelAngel: Infostealer logs, what happens to stolen credentials after infection