ClickFix scam: never paste a command from a website

A new round of the ClickFix scam was found on 28 October 2026. A hacked website shows a fake "verify you are human" box styled like Cloudflare. It asks you to open a box on your computer, paste a command and press Enter. That command downloads malware. It works on both Windows and Mac. Real websites never ask you to do this, so close the page.

How does the ClickFix trick work?

You open a normal looking website, often one that was hacked, or a link from an email or an advert. A box appears that looks like a security check. When you click it, the page secretly copies a command to your clipboard. Then it shows short steps:

• On Windows: press the Windows key and R, press Ctrl + V, then press Enter.
• On a Mac: open Terminal, paste and press Enter.

Because you run the command yourself, antivirus software may not stop it. Microsoft says these campaigns reach thousands of computers a day. The malware they deliver includes programs that steal saved passwords and browser logins, and remote control tools that let the attacker use your PC.

Who is at risk?

Anyone who uses a computer for work, at home or in the office. Staff who handle payments, email and online banking have the most to lose, because the malware looks for saved logins.

What to do

1. Tell your staff the simple rule: no website, CAPTCHA or "verification" ever needs you to press Windows + R or open Terminal and paste something. If a page asks, close it.
2. If someone already did it, unplug that computer from the network or turn off its Wi-Fi, then call your IT support. Do not keep using it for banking or email.
3. From a clean device, change the passwords for email, banking and any account saved in that browser. Turn on two-step login.
4. Keep Windows Defender or your antivirus on and updated. Microsoft also suggests turning on SmartScreen in Windows.
5. Office IT teams can block the Run box for staff who do not need it.

If your own website starts showing a box like this to visitors, it has been hacked and needs cleaning at once. Our hacked website clean-up and care service can help with that. To cut the phishing emails that lead staff to these pages, see our spam filtering for business email.

Source and credit

We are sharing this news from the SANS Internet Storm Center and Microsoft. This summary is written by Synctech in our own words.

• Yet Another ClickFix Campaign, SANS Internet Storm Center (Brad Duncan), 28 October 2026: https://isc.sans.edu/diary/33466
• Think before you Click(Fix): Analyzing the ClickFix social engineering technique, Microsoft Threat Intelligence, 21 August 2025: https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Retrieved 29 October 2026. Microsoft, Windows, Cloudflare and Mac are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.