ClickFix: the fake "verify you are human" page that installs malware

ClickFix is a trick in which a web page pretends to check that you are human, or to fix an error, and tells you to press a few keys and paste something into your computer. What you paste is a command the page has quietly copied for you, and running it installs malware, usually a program that steals saved passwords. No genuine CAPTCHA or security check ever asks you to paste anything into your computer. Many of these pages appear on ordinary websites that have been hacked, which makes the trick a problem for website owners as well as visitors.

How the trick works

1. You open a web page. It may be a site you know, a link in an email or an advert at the top of a search.
2. The page shows something familiar: a "verify you are human" box, a browser error or a "fix this problem" button.
3. When you click, the page copies a command to your clipboard without telling you.
4. It then gives you "verification steps": press a key combination that opens a command box on Windows, or open Terminal on a Mac, paste, and press Enter.
5. The command downloads and runs malware. Because you ran it yourself, many security checks treat it as something you meant to do.

The real verification that sites use asks you to tick a box, pick out pictures or wait a moment. It never asks you to open anything on your own computer.

How common it is

Proofpoint, a security company, first documented the technique in June 2024, having first seen it in March of that year. It has grown quickly since.

• Microsoft found ClickFix was the most common way attackers first got in across the incidents its Defender Experts service notified customers about in its 2025 report year, at 47 per cent.
• Microsoft's 2026 report counts more than 1.1 million devices that ran ClickFix-style commands between February and early May 2026, about eight times more than before.
• Government agencies in the United States, New Zealand, Switzerland, Poland, Singapore and the European Union have issued warnings. In the US, CISA and the FBI listed it as one way into networks later hit by ransomware.

Most of what ClickFix installs are infostealers, such as Lumma and Vidar, and remote access tools. Our article Saved passwords, stolen in seconds explains what an infostealer takes and why it is so damaging.

Macs are targeted too, through Terminal and Script Editor. Apple added a "Possible malware, Paste blocked" warning in macOS 26.4, and attackers have already moved to other routes, so a Mac is no reason to relax.

Why hacked websites spread it

The New Zealand National Cyber Security Centre (NCSC NZ) warned in September 2026 that ClickFix campaigns commonly use compromised WordPress websites. The site's owner has done nothing wrong except leave a door open, and the fake check appears to the site's own visitors.

Security researchers have counted the injected code on thousands of sites per campaign. Sekoia, for example, found more than 9,300 infected sites in one campaign. The attackers get in through:

• outdated WordPress, plugins or themes with known security flaws
• stolen administrator passwords, used to install a fake plugin that looks harmless
• code hidden in theme files or the database, where it survives a casual look

Some campaigns store the next stage of the attack on a public blockchain, so it cannot be removed by taking down one server.

Why owners do not notice

The malicious code is often written to hide from the people who would spot it. Google, GoDaddy, Sucuri and NCSC NZ all describe injected code that does not show to logged-in administrators, to search engine bots or to security scanners. The owner sees a normal site; a first-time visitor on a phone sees the fake check.

Signs that your site may be affected:

• Google Search Console reports a security issue, or browsers show a warning for your site
• visitors or customers tell you about a strange "verify" page
• an antivirus program flags your site
• there are administrator accounts or plugins you do not recognise

NCSC NZ suggests checking your own site while logged out, in a private window, on a different network and on a phone.

What to do as a site owner

• Keep WordPress, plugins and themes updated, and delete those you do not use.
• Give every administrator a strong, unique password and two-factor sign-in. Updates alone are not enough: Sekoia found many infected sites were already up to date, entered with stolen passwords. Our guide How to set up two-factor authentication in WordPress shows how.
• Keep usable backups you can restore from.
• If your site is infected, fix the way in, not only the symptom. NCSC NZ warns that removing the visible prompt without closing the entry point and removing what the attacker left behind means it comes back.

If you ran the command

1. Stop. Do not run anything else the page suggests, and disconnect the computer from the network if you can.
2. Get the computer checked and cleaned. NCSC NZ and the Swiss National Cyber Security Centre both say to have the device cleaned before trusting it again. Because an infostealer may already have copied your passwords and signed-in sessions, Noiz recommends a full reset of the operating system rather than relying on a scan.
3. Change your passwords from a different, clean device, starting with your email, then your banking, your website and your hosting control panel.
4. Sign out every other session on the accounts that matter, because a stolen session can keep working after a password change.
5. Tell your bank if card or banking details were saved in the browser, and report the incident to your organisation's IT contact.

Where Noiz fits

Noiz WordPress Care looks after a WordPress site so its owner does not have to: weekly updates of core, themes and plugins with a restore point first, scanning for known plugin and theme vulnerabilities with patches applied as fixes are released, and hack fix and recovery if a site is compromised. It can be added to a Noiz hosting plan or a Cloud server, or taken on its own for a site hosted elsewhere.

If your WordPress site would rather not be the next one serving fake checks, add WordPress Care.

Sources

• Proofpoint, From clipboard to compromise (17 June 2024): https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
• Proofpoint, state-sponsored actors try ClickFix (17 April 2025): https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix
• Microsoft, Think before you ClickFix (21 August 2025): https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
• Microsoft Digital Defense Report 2025: https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf
• Microsoft Digital Defense Report 2026 (1 October 2026): https://www.microsoft.com/en-us/security/security-insider/threat-landscape/2026-digital-defense-report
• Microsoft, macOS ClickFix campaign (5 August 2026): https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
• CISA and FBI, Interlock ransomware advisory AA25-203A (22 July 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
• NCSC New Zealand, compromised websites serving ClickFix pages (2 September 2026): https://www.ncsc.govt.nz/alerts/compromised-websites-serving-clickfix-pages/
• Swiss National Cyber Security Centre (24 February 2026): https://www.bacs.admin.ch/en/26w8-en
• CERT Polska, fake CAPTCHA in action (17 February 2026): https://cert.pl/en/posts/2026/02/fake-captcha-in-action/
• CERT-EU, CB25-11 (3 November 2025): https://cert.europa.eu/publications/threat-intelligence/cb25-11
• Singapore Cyber Security Agency, AL-2025-068: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-068/
• Sucuri, WordPress ClickFix malware (21 February 2025): https://blog.sucuri.net/2025/02/wordpress-clickfix-malware-causes-google-warnings-and-infected-computers.html
• GoDaddy, ClickFix fake browser updates using stolen credentials (17 October 2024): https://www.godaddy.com/resources/news/threat-actors-push-clickfix-fake-browser-updates-using-stolen-credentials
• Google Threat Intelligence Group, UNC5142 (16 October 2025): https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware
• Sekoia, IClickFix (29 January 2026): https://www.sekoia.com/blog/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic
• Sekoia, ClearFake (18 March 2025): https://www.sekoia.com/blog/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery
• Jamf Threat Labs (8 April 2026): https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/
• Apple Support, paste blocked warning: https://support.apple.com/en-gb/127377
• Google Search Central, spam policies: https://developers.google.com/search/docs/essentials/spam-policies
• Google Search Console, security issues report: https://support.google.com/webmasters/answer/9044101
• WordPress.org, FAQ my site was hacked: https://wordpress.org/documentation/article/faq-my-site-was-hacked/

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.