ClickFix scams: why fake verification pages ask you to run commands

The durable rule

A legitimate CAPTCHA or ordinary human-verification page should not require you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands.

The U.S. Federal Trade Commission has warned specifically about fake CAPTCHA pages that imitate familiar verification screens and then instruct people to use operating-system shortcuts to paste and run hidden malware. Microsoft tracks this broader social-engineering technique as ClickFix.

That is a useful rule because it focuses on the requested action, not on whether the page looks professional.

How ClickFix works at a high level

ClickFix reverses the normal security relationship. Instead of exploiting the browser directly, the attacker persuades the visitor to perform the dangerous action themselves.

The lure can look like:

• a CAPTCHA or “verify you are human” screen;
• a fake Cloudflare-style or browser security check;
• a message saying verification failed;
• a fake software/browser update;
• a download or document that supposedly needs a “fix” before it will open.

The page then asks the visitor to open an operating-system command interface and paste or execute something. The exact payload and malware family can change. The durable warning is that a routine verification page has no legitimate reason to make you run a system command.

ScamMark Safety Rule

Stop if a verification page asks you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands.

ScamMark treats a strong match to that pattern as a deterministic safety rule, not as a generic grammar or “looks suspicious” heuristic.

The ScamMark checker can analyze pasted instructions locally in your browser. The website checker can also look for strong command-style verification patterns in ordinary retrieved HTML without executing the page's JavaScript or commands.

Why the page can still look convincing

A fake verification page can copy familiar logos, colors, progress indicators and wording. HTTPS does not make the instructions trustworthy; it only encrypts the connection to the site you reached.

Security research has also documented campaigns that vary what a visitor sees based on browser, device, location or other characteristics. That means an automated fetch may not always receive the same page a human visitor saw. A clean automated check cannot prove that a site never serves ClickFix content.

If you have not run the command

Do not paste or execute it. Close the page or tab. If you were trying to reach a known service, navigate to that service through an address or app you found independently rather than continuing through the suspicious prompt.

If the prompt came from a link in a message or advertisement, preserve the message and exact URL if you may need to report it.

If you already ran the command

Treat the device as potentially compromised. Disconnect it from the network if practical, use a trusted device to secure important accounts, and follow the ScamMark recovery guidance. The FTC also recommends security scanning and changing passwords from a different trusted device when malware may have been installed.

Do not keep experimenting with the command to determine what it does.

Enduring technique vs. campaign examples

The ClickFix technique is durable. Individual domains, malware names, command payloads and advertisement campaigns are time-sensitive examples and can disappear quickly. ScamMark therefore uses campaign research to explain the technique, while the reusable safety rule remains focused on the action the page is asking you to take.