ClickFix Fake CAPTCHAs: What We Found and What to Tell Your Staff

Hackers & Hooks | Bonus Episode

One of our team members was not hunting for threats. She was searching for local business conferences, clicked a result for what looked like a local business expo, and was asked to prove she was not a robot. Then the page asked her to do something no real website ever should: open a command window on her computer and paste in a line of code.

In this short bonus episode of Hackers & Hooks, Nick Gipson walks through what Gipson Cyber found when we looked closer, how a forgotten website became a trap for its own visitors, and what every small business should tell its staff about this widely used trick.

A “Verify You Are Human” Box That Was Anything But

The page showed what looked like the familiar reCAPTCHA checkbox that many sites use to screen out bots. After clicking it, a set of instructions appeared. Press the Windows key and X to open a terminal (the text window where you can type commands straight to the computer). Press Ctrl and V to paste. Then run what you pasted. Behind the scenes, the page had already copied a command onto the visitor’s clipboard.

“That is not standard reCAPTCHA behavior at all. If you ever see something like this, back out of the site immediately.”

Nick Gipson, Hackers & Hooks

Instead of running the command, Nick pasted it somewhere safe and decoded it. Under the scrambled text was a short PowerShell script (PowerShell is a built-in Windows tool for automating tasks). Its job was simple: reach out to a web address controlled by the attacker, download another script under a random file name, and run it. Security teams call this a payload dropper, a small first-stage program whose only purpose is to pull down more powerful malware. Several security vendors had already flagged the destination as malicious.

How a Forgotten Website Turned on Its Own Visitors

At first, Nick suspected a copycat site built to imitate the real expo. The evidence pointed somewhere else. This was an old event website for a local business expo that had been left online after the event was over. Nobody was maintaining it. Someone had compromised it and planted the fake CAPTCHA, turning a trusted name and a good search ranking into a way to reach people who were looking for that event.

Nick wrote up what he found and alerted the site owner and the domain registrar, and the site was taken down. There is no way to know how many visitors followed the instructions before that happened.

This attack pattern is widely known as ClickFix. Researchers at the security firm Proofpoint gave it that name in 2024, and it has since been adopted by an increasing number of attackers. Some versions target Mac users through the Terminal app, not just Windows users. Government security agencies have warned that hacked legitimate websites, often WordPress sites, are a common way it reaches people. The trick works because the visitor runs the command themselves, which can make the activity look like normal use to some security tools.

For a business, one pasted command can lead to real damage. These campaigns commonly install information stealers (malware that collects saved passwords and logged-in browser sessions) or remote access tools that let an attacker into the computer. From there, the risks include a hijacked email account, fraudulent payment requests sent in your name, exposed customer data, and in some cases ransomware and days of downtime. There is a reputational cost, too. In this case, the expo’s own name was being used against the very people trying to attend it.

“My salesperson wasn’t going out and actually finding threats. She was just trying to find a conference and ran across this.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Give your staff one simple rule. No real website, CAPTCHA, or “browser fix” will ever ask you to press Windows and R, Windows and X, or open Terminal on a Mac and paste something in. If a page asks you to do that, close the tab and tell someone.
• Make reporting fast and blame-free. Tell staff exactly who to contact, and make it clear they will not be in trouble for reporting, even if they already ran the command. A quick report matters far more than an awkward one.
• If someone already ran it, act right away. Disconnect that computer from the network (unplug the cable or turn off Wi-Fi), stop using it, and call your IT provider or an incident response team. Change important passwords from a different device that you trust.
• Limit who can run scripts. Most employees never need PowerShell. Ask your IT team or MSP whether it can be restricted to the people who use it, and whether that kind of activity is being monitored.
• Retire websites you no longer use. Old event pages, campaign sites, and forgotten domains still carry your name. Take them down, or make sure someone owns them and keeps them updated. An abandoned site can be turned against your own customers.

How Gipson Cyber Helps

This finding came from an ordinary web search on an ordinary workday, and that is the point. Risk shows up where people are just trying to get their jobs done, so it helps to have someone watching when they cannot.

Gipson Cyber’s Business SOCaaS provides 24/7 cybersecurity monitoring for small business, with real human responders. It works with the tools you already have and alongside your existing IT team or MSP, not in place of them. If someone on your team has already pasted a command they should not have, our Business DFIR team provides small business incident response: helping you contain the problem, find out what happened, and get clear reporting on what to do next.

No tool or training program can stop every click. What helps is a team that knows the warning signs and a partner ready to respond when something slips through. If you think you are being hacked right now, go to 800cyber.com.