ClickFix Trick: “Not a Robot” to Run Commands

The article describes a real-world social engineering technique called ClickFix that Microsoft observed frequently: a fake “prove you’re not a robot” page silently copies a command to the user’s clipboard and then instructs them to paste it into a terminal. Because the user runs the command themselves and no attachment is delivered, it can bypass many traditional security checks and becomes easy for attackers to repeat at scale.

Key findings

• ClickFix uses a fake “prove you are not a robot” webpage to get users to paste a pre-copied command into a terminal.
• Microsoft observed ClickFix as a dominant initial access method in its notifications (reported as 47%).
• Bitdefender reports many high-severity incidents rely on “living off the land” (using built-in tools already present on systems) rather than installing obvious malware.
• The article argues attackers prioritize repeatable playbooks over “clever” one-off attacks, enabling high-volume operations.

Who’s being targeted

• Commonly targeted roles: All employees, Executive team, IT helpdesk / support, Security operations (SOC/MDR consumers).
• Affected industries: Cross-industry (any organization with end users and web access).
• Attack channels: website.
• Impersonated: A generic website verification/CAPTCHA page.

Awareness takeaways

• Train employees: a real CAPTCHA will never ask you to open a terminal or paste commands, stop and report immediately.
• Reinforce “don’t run what you don’t understand”: pasting commands from a webpage is equivalent to installing software.
• Focus defenses on repeatable attacker playbooks (not just ‘advanced’ malware): reduce what can run and who can run it.
• Don’t rely on detection alone, ensure alerts are actively monitored and acted on.

Red flags to watch for

• A CAPTCHA/verification step instructs you to open Terminal/Command Prompt (unusual for normal web browsing).
• Instructions require pasting and running a command you did not type or understand.
• The page manipulates your clipboard without clear consent or business reason.