Note, 25 October 2026

ClickFix, and why a real CAPTCHA never asks for keyboard shortcuts

A page shows an "I'm not a robot" check. To pass, it says, press Windows+R, then Ctrl+V, then Enter. Those three keys paste and run a command the page has already copied, and the command installs malware. It is called ClickFix. In June the FTC put the rule in one line: "Real CAPTCHAs won’t ask you to run commands on your device."

How the trick works

Switzerland's National Cyber Security Centre, the NCSC, described the steps in February 2026. Just opening the page copies a command to the clipboard, one made for Windows or one for macOS. The page then asks for "seemingly harmless keyboard shortcuts". In reality, the NCSC says, they open the command line and paste the code, and Enter runs it. The FTC's alert names the same three keys.

Nothing on the computer is broken into. The person runs the command, so the download happens "within their own permissions context", and "many security mechanisms do not raise an alert", the NCSC writes. Microsoft said the same in August 2025: a ClickFix campaign "could get past conventional and automated security solutions." What usually arrives is an infostealer, malware that takes passwords saved in the browser, crypto wallets and session cookies. The cookies let attackers into email or company accounts without a password. In a company, the NCSC adds, this can be "the first step towards a later ransomware attack".

How common it is

Microsoft first saw the technique between March and June 2024, in email campaigns. By August 2025 it saw campaigns "targeting thousands of enterprise and end-user devices globally every day", on Windows and macOS. The lures come by phishing email, by malicious ads, and from hacked or fake websites.

On 7 August 2026 the Swiss NCSC reported a rise in hacked websites that show visitors fake CAPTCHAs: "More than 100,000 websites worldwide are affected." It was tracking seven campaigns. Microsoft's Digital Defense Report 2026, dated October, lists "ClickFix-style social engineering" among the ways attackers still get in through people.

How to tell, and what to do if you pressed Enter

The tell is the keyboard. A real CAPTCHA gives you a picture or text puzzle, the FTC says, such as typing letters exactly as they appear. A fake one wants keys that open something on your computer. The Swiss NCSC's advice: "Never run a computer command, such as pressing the Windows key + R, because a website instructs you to do so. Leave the website immediately." Browser updates, it adds, come from the browser's own settings, not from a website.

If you already did it, the FTC says to act quickly. Disconnect from the internet. Run a security scan to remove the malware. Change your passwords and turn on two-factor authentication, using a different device. In the US, report the page to the FTC at ReportFraud.ftc.gov. The Swiss NCSC also asks victims to report the incident. For companies, Microsoft suggests blocking the Run box for people who don't need it in their daily work.

What we would build instead

Our take: no patch fixes a step the user performs. The person runs the command, so the fix has to be a rule they remember: a real CAPTCHA never asks for keyboard shortcuts. The Swiss NCSC calls knowing that a website would never legitimately ask someone to enter system commands "one of the most effective protective measures".

A rule only works if it has no exceptions, and our own industry keeps making them. Many install guides ask you to paste a line into a terminal. Some support pages tell you to press Win+R and type. Each one teaches that a trusted page may ask you to run something. ClickFix reuses that lesson.

So, for anyone who ships software or devices: never build a setup, support or verification step that asks a user to paste or run a command. Ship a signed installer, or put the action in the app as a button. If a device needs setting up, do it from its own app over a signed channel, not with a line typed into a laptop. If your product checks for humans, it never needs a key press outside the page. And if a company blocks the Run box, as Microsoft suggests, nothing you ship should need it.

Transcript

A stick-figure gamer on a "FREE SKINS" site. An "I'm not a robot" box with a face.

Box: Quick check! Are you human?

Kid: Yes? I think so.

Box: Great! Tick the box.

Box: Now press Windows and R.

Kid: Why?

Box: Robots can't do that.

Box: Now Control V.

Kid: What's that?

Box: Human stuff. Now press Enter.

The box bursts open. Inside is a hooded hacker.

Hacker: Thanks for the passwords!

On screen: A real CAPTCHA never asks you to press keys.

All notes