Fake \"I'm Not a Robot\" Pages Are Installing Malware on Your Computer

Threat level

You land on a webpage and see a familiar "Verify you are human" checkbox. You click it. A box appears with instructions to press a few keyboard keys to "complete verification." Those keystrokes silently run a command that downloads malware onto your computer. This attack, known as ClickFix, has been active and growing since late 2025.

Quick Summary

Fake CAPTCHA pages trick you into running a hidden malware command using your own keyboard
Real CAPTCHAs never ask you to type keyboard shortcuts or paste anything
Fix: If a verification page asks you to press keyboard shortcuts, close the browser tab immediately

How This Scam Works

Real CAPTCHAs ask you to click a checkbox or solve a simple puzzle. Fake CAPTCHAs give step-by-step instructions to press Windows key + R, paste a command, and press Enter to "complete verification." What you are actually doing is executing a script that downloads malware in the background.

What To Do Right Now

1

Close the browser tab immediately.

Do not follow the instructions.

2

Real CAPTCHAs never ask you to:

Press keyboard shortcuts, open a Run box or Terminal, paste anything, or download a file.

3

If you already followed the steps:

Disconnect from WiFi, run a full antivirus scan, and consider contacting a tech professional.

4

Report the website.

Submit the URL to Google's Safe Browsing report tool.

Stay Protected Going Forward

No legitimate website ever needs you to type commands into your computer to prove you are human. Share this article with anyone in your family who uses a computer regularly.

Get simple, clear protection guides for your whole family. Visit simpledigitalsafety.com/shop