ClickFix: The Fake CAPTCHA That Asks You to Run a Command

You land on a website and a familiar-looking box asks you to prove you are human. Instead of ticking a box, it tells you to press the Windows key and R, paste something and press Enter. Do not. This is a technique called ClickFix, and the Australian Signals Directorate (ASD) has published an advisory about it.

How the attack works

1. Attackers break into a real Australian business website, often one running WordPress.

2. The site starts showing a fake Cloudflare "prove you are human" check.

3. Behind the scenes, the page copies a command to your clipboard.

4. You are told to press Windows + R, paste and run it.

5. That installs Vidar, malware that steals saved passwords and browser data.

Because the page sits on a legitimate site your staff may already trust, the usual instinct to avoid shady websites does not help.

The one rule to teach everyone

A real security check never asks you to run anything on your computer. If any page tells you to open the Run box, a terminal or PowerShell, close it. Put that sentence in your next staff update.

If someone already ran it

• Disconnect the device from the network and tell your IT provider straight away.
• Treat every password saved in that browser as stolen and change them from a different, clean device.
• Check for sign-ins you do not recognise on email and financial accounts. Multi-factor authentication helps here, see our guide.
• Follow our steps in what to do after a cyber attack.

Check your own website too

The same campaign relies on out-of-date or poorly protected sites. If you own a website, ask whoever looks after it the questions in Is your website patched? Or read the broader article, ClickFix: the fake CAPTCHA that asks you to run a command.

Keeping software patched is a core part of the Essential Eight. If you want a hand, contact Defy IT.