That ‘Verify You’re Human’ Box Wants You to Run a Command
The CAPTCHA That Isn’t a CAPTCHA
You’ve clicked a thousand of those little ‘I’m not a robot’ boxes. Pick the traffic lights, check the box, move on. Attackers know you do it on autopilot, and they built a scam around that exact habit.
Security folks call it ClickFix, or a fake CAPTCHA attack. Here’s how it plays out on a normal Tuesday at a normal office.
How the Scam Works
Someone on your team searches for a supplier, opens a link from an email, or lands on a hacked local website. A page pops up that looks like a standard human check. Then it asks for something weird:
- Press the Windows key and R at the same time
- Press Ctrl and V
- Press Enter
Three keystrokes. Looks like a verification step. What actually happened is the page quietly copied a command to the clipboard the moment they clicked the box. Windows+R opens the Run box. Ctrl+V pastes the attacker’s command. Enter runs it.
Your employee just installed malware by hand. No sketchy attachment, no download prompt, no warning popup. Most of the time it’s an info stealer that grabs saved browser passwords, session cookies, and anything else worth money, then ships it all off in seconds.
There’s a Mac version too. It asks you to open Terminal and paste. Same trick, different keyboard.
Why It Works So Well
Most security training says don’t open weird attachments and don’t click weird links. This scam does neither. The person is following instructions on a page that looks normal, doing something that feels harmless.
It also slips past a lot of protection. Email filters never see a file. Antivirus often sees a legit Windows tool like PowerShell running a command, which is something admins do all day. By the time anything flags it, the stealer may have already sent its haul.
And the lure isn’t always a CAPTCHA. I’ve seen versions dressed up as a ‘fix this error’ button on a fake Word document, a broken video player, even a fake browser update. The common thread never changes. The page wants you to paste something and run it.
What This Means for YOU
Think about what’s saved in a typical office browser. The bank login. QuickBooks. The Microsoft 365 admin account. The payroll portal. A stealer doesn’t need to break anything. It just copies the keys you already left lying in the browser.
Stolen session cookies are the nasty part. They can let an attacker skip your MFA, because the browser already proved who you are. So even a well-protected account can get walked into.
The One Rule Everyone Needs to Know
No real website will ever ask you to press Windows+R, open Terminal, or paste something into a command box to prove you’re human. Ever. Google doesn’t. Cloudflare doesn’t. Microsoft doesn’t. If a page asks, close the tab.
That’s the whole lesson. Put it on a sticky note by the monitor if you have to (just not the one with the password on it).
Practical Steps for a Small Office
1. Tell your team this week
Send a short email with a screenshot of one of these fake pages. A quick image search turns up plenty. People remember a picture way better than a paragraph. Make it clear nobody gets in trouble for reporting one, even if they already pressed the keys. Fast reporting matters more than pride.
2. Stop saving passwords in the browser
Move everyone to a real password manager. Stealers go after the browser’s built-in password store first because it’s easy pickings. A manager with its own lock is a much harder target.
3. Take away admin rights
Some of these payloads run fine as a normal user, but the follow-up steps get a lot worse when the person is a local admin. Regular staff shouldn’t be admins on their own machines. Period.
4. Lock down the Run box and PowerShell where you can
If you’re on Microsoft 365 Business Premium or use Intune, you can restrict PowerShell for regular users and turn on attack surface reduction rules in Defender. A front desk computer that never needs a command line has no reason to keep one open. Get someone who knows Group Policy or Intune to set this up, though. It’s easy to break things for the one person who does need it.
5. Have a plan for ‘I think I clicked it’
If someone ran the command, unplug that computer from the network. Then, from a different device, change the passwords for anything saved in that browser and sign out of every active session in Microsoft 365, Google, and the bank. Signing out is the step people skip. Changing a password alone won’t always kick out an attacker who’s holding a live session cookie.
The Bigger Lesson
Attackers keep moving to whatever people haven’t been warned about yet. A few years ago it was attachments. Then links. Now it’s getting you to do the dangerous part yourself, because no filter can block a person following instructions.
That’s why short, regular security awareness training beats a once-a-year slideshow. Scams change every few months. Your team needs to hear about the new ones while they’re still new.
If you want your team trained on scams like this one, check out what we offer at yourtech.solutions. And if you’ve run into one of these fake CAPTCHA pages yourself, I want to hear about it.