Learn about ClickFix with Hugo & River.
What Is ClickFix? The Fake Website Check That Could Put Your Business at Risk
You visit a vendor’s website you’ve used dozens of times. A CAPTCHA appears and asks you to prove you’re human. So far, nothing seems unusual.
Then it tells you to press Windows + R, paste a command, and hit Enter.
That is not a verification step. It could be a ClickFix scam.
How ClickFix works
ClickFix is a scam that tricks someone into running a malicious command on their own computer. It often appears as a fake CAPTCHA, an error message, or a prompt to “fix” a problem before continuing to a website.
In one common version, the attack follows these steps:
• An employee lands on a compromised website or a convincing fake page.
• A pop-up presents what looks like a routine verification check.
• The page quietly copies a command to the employee’s clipboard.
• The employee is told to open the Windows Run box with Windows + R, paste with Ctrl + V, and press Enter.
Opening the Run box alone does not compromise the computer. The danger is running the pasted command. Depending on the attack, that command can download malware, steal information, or give an attacker access to the device.
Why should a business owner care?
An employee does not have to visit an obviously suspicious website for this to happen. Attackers have placed ClickFix prompts on compromised sites that people already know and use. The page may look familiar right up until it asks the employee to do something outside the browser.
If the command runs, the risk can extend beyond one computer. Attackers may try to steal saved passwords or active sign-in sessions, access business email and other applications, or install tools that let them return later.
For a business, that can mean disrupted work, exposed information, and time spent figuring out what the attacker reached.
What should you do if you see a ClickFix prompt?
Do not paste or run the command. Take a screenshot of the page using Snipping Tool, including the website address if possible. Then close the page and send the screenshot to your IT provider or submit a support ticket. The screenshot gives them something to investigate without requiring you to interact further with the prompt.
If you have already run the command, contact your IT provider immediately. Tell them what happened and roughly when, even if your computer seems to be working normally.
What can your business do now?
Share this warning sign with employees: A website should never ask them to open Windows Run box, PowerShell, or another app and paste in a command to prove they’re human. Make sure they know how to report a suspicious page and whom to contact if they’ve already run a command.
Your IT provider should also be able to explain how they monitor devices, investigate suspicious activity, and respond when an employee reports something like this.
Not sure what would happen if an employee at your business ran a suspicious command? Talk to Systems Integration. We can help you understand how your devices are protected and what your response would look like.