How ClickFix Attacks Turn a Fake CAPTCHA Into Remote Code Execution

ClickFix is a social-engineering technique that outsources the hardest part of an attack — getting code to run on the target — to the victim. Rather than exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. a software vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm., the attacker presents a convincing reason for the user to copy a command and run it themselves. The TerminalFix campaign documented by Microsoft in August 2026 is a current, unusually complete example: a fake Cloudflare CAPTCHA that ends in a Python reverse-tunnel implant. Understanding the underlying pattern matters more than any single campaign, because the lure is reused constantly while the payload changes.

The Core Trick

Every ClickFix attackClickFix Attack🛡️A social engineering technique that tricks users into running commands or completing actions on their computers, typically disguised as fixing an error or completing a verification step. has the same shape. The victim lands on a page — often a compromised legitimate site — that displays a problem and a fix. The classic framing is a human-verification challenge: "Verify you are human," complete with a spinner and a familiar logo. The page instructs the user to complete a few steps: press a key combination, paste, and press Enter. What the user does not see is that a malicious command was silently placed on their clipboard by the page. When they paste and run it, they execute the attacker's code with their own privileges, on their own machine, having bypassed every network and email control that would normally sit in the way.

The brilliance, and the danger, is that no exploit is involved. There is no malicious attachment for a gateway to detonate, no macro for a policy to block, no CVE to patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.. The security boundary that fails is the human one.

Why the Terminal Variant Is Worse

Traditional ClickFix campaigns direct victims to the Windows Run dialog (Win+R). The TerminalFix variant instead tells users to open Windows Terminal or PowerShell. This is a deliberate upgrade. The Run dialog is awkward for long or multi-line commands; a real terminal handles them cleanly. By moving the instruction into a shell, attackers can deliver complex, staged scripts that download archives, extract payloads, and establish persistence in a single paste. It also normalizes a dangerous habit: pasting multi-line scripts into a terminal because a website told you to.

What Makes the Lure Convincing

The fake CAPTCHA works because it mimics a screen users have been trained to trust and dismiss quickly. Human-verification prompts are everywhere, they interrupt an intended task, and users click through them without much thought. The attacker exploits that reflex. The page copies text to the clipboard the moment the user interacts, and the on-screen instructions frame running a command as the verification step itself. Some campaigns even print fake success messages afterward, so the victim believes the check passed and moves on — while a background process is already staging the next payload.

Why It Bypasses So Many Defenses

Because the user runs the command, the code executes in a fully trusted context. Downstream stages then lean on living-off-the-land tooling — signed Windows binaries, the official Python interpreter, ordinary image files carrying hidden payloads — so signature-based inspection sees nothing obviously malicious. This is the same evasion logic behind DLL sideloadingDLL Sideloading🛡️An attack technique that places a malicious DLL alongside a legitimate signed executable so the Windows loader resolves and loads the attacker's library instead of the real one, running malicious code under the trust of the signed program., where a trusted signed executable loads an attacker's library. The initial-access technique and the post-access techniques reinforce each other: both are designed to look legitimate.

Breaking the Chain

The most durable defense is to remove the capability the attack depends on, not just to warn users about it. If standard users cannot run arbitrary scripts, the paste step fails no matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility. how convincing the lure. Practically, that means restricting PowerShell and the Run dialog for non-administrative users, enforcing PowerShell Constrained Language ModeConstrained Language Mode🛡️A PowerShell operating mode that restricts access to sensitive language features such as arbitrary .NET type instantiation and Win32 API calls, blocking common in-memory attack tradecraft while allowing most legitimate administrative scripting to continue., and auditing terminal usage. Configuring the terminal to warn when pasted text spans multiple lines gives the user one more chance to stop. These are the same controls covered in depth in guidance on hardening PowerShell and the Windows Run dialog against paste-and-run attacks.

Awareness still has a role. Users should learn one simple rule: a legitimate website will never ask you to open a terminal and paste a command to prove you are human. That single heuristic defeats the entire class. But awareness is a backstop, not a control — the reliable fix is to make sure that even a user who falls for the lure cannot execute the payload. And because the endgame of these campaigns is often internal-network access, detecting a reverse-tunnel implant on outbound connections remains an essential last line of defense.