ClickFix explained: when a fake CAPTCHA asks you to run a command

The details vary, but the sequence commonly has three parts:

1. A page presents a problem or verification request.
2. It supplies text and asks you to move into a command tool.
3. Running the instruction can download or launch malicious software.

1. The page supplies a reason to continue

Purpose: Notice the problem the page wants you to solve.

The prompt might say that a document cannot open or a security check has failed. Its apparent solution is positioned as a small step towards the thing you already wanted to do.

2. The instructions move outside the browser

Purpose: Recognise when the request changes from a check to device control.

The page may place text on your clipboard, the temporary store used for copying and pasting. It then tells you to open a command tool and paste that text. You may not have deliberately selected the command yourself.

3. Running the text can start the infection

Purpose: Distinguish copying an instruction from executing it.

Execution means the computer acts on the instruction. It may retrieve malware, which is software designed to cause harm. Some campaigns deliver information stealers that can take passwords or browser session data. Session data can help an attacker use an existing signed-in account.

“Complete verification to continue”

“Verification could not finish. Copy the verification text, open your computer’s command window and run it to unlock the tutorial.”

This is an invented teaching example. It contains no executable command, download or real service branding.

You saw the prompt and stopped

Purpose: Leave the questionable request and use a trusted route.

Close the page without following its repair instructions or using support details displayed in the prompt. For a suspected browser update problem, open the browser’s own settings. On a work device, report the page through your organisation’s usual route.

The prompt alone does not establish that your device is infected. If you are concerned about a suspicious link or download, the UK NCSC recommends running a full scan with your existing antivirus software. Read the NCSC’s advice after interacting with a scam.

Text was copied or pasted, but not run

Purpose: Keep the instruction from being executed.

Do not run it to see what happens. If it is sitting in a command tool, close that tool without executing the text. Replace suspicious clipboard contents by copying a harmless word from a document you trust.

Tell your support team whether the text was merely copied, pasted, or possibly executed. If you cannot tell, say so. You do not need to experiment to give a useful report.

You ran the command, or are unsure

Purpose: Get help with both the device and potentially exposed accounts.

For a work device, contact your IT or security team immediately through a known route, using another device if needed. Give them the approximate time, the page you visited and what you did. Follow their containment and recovery instructions.

For a personal device, use trusted security support and follow the NCSC’s infected-device recovery guidance. Open your existing security software directly rather than downloading a “cleaner” offered by the suspect page. A scan can help, but it does not guarantee that an executed command caused no harm.

Use a device you trust to follow the affected services’ account-recovery instructions. This can include changing compromised passwords, checking account settings and signing out other sessions. Removing malware does not itself recover information already stolen. Read the NCSC’s account-recovery steps.

A five-minute team check

• Show the fictional prompt above and ask what changes when it requests a command tool.
• Confirm where colleagues should report a suspicious page or an accidental execution.
• Agree who can help check unfamiliar technical instructions.
• Ask your security team which device protections and restrictions are appropriate for your environment.

Make it easy to report a mistake. “I ran something and I am not sure what it did” gives a support team a starting point. Shaming someone for speaking up makes the next incident harder to discover.

Pause, check and find trusted support

Coded Female’s Spot the Scam gives you eight fictional situations per round, drawn from a bank of 20. It practises broader scam recognition, including fake technical-support pop-ups and requests for access.

As you play, identify what the message wants you to do and which route could verify the request independently. Use a hint when you need one and read the explanation after answering.

The game uses fictional messages and simulated choices. It does not require you to run commands or contact the people described.