A "security verification" CAPTCHA tells you to press keyboard shortcuts — then installs malware
A fake Cloudflare or browser-check CAPTCHA on a hacked Australian website instructs you to press Windows+R, Ctrl+V, then Enter — secretly running malware already placed on your clipboard. It steals bank passwords, cryptocurrency wallet keys, and browser-saved credentials. ASD/ACSC issued a specific warning for Australia in May 2026.
Also known as: ClickFix scam Australia, fake Cloudflare CAPTCHA malware, keyboard shortcut virus AU, PowerShell clipboard attack, Vidar Stealer Australia
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 If you have not yet pressed the keys: close the browser tab immediately — do not complete the CAPTCHA instructions
- 2 If you already pressed Enter: disconnect from the internet immediately, then run a full antivirus or anti-malware scan before reconnecting
- 3 Change all passwords — for banking, super, myGov, email, and crypto accounts — from a separate, clean device
- 4 If you hold cryptocurrency, move funds to a new wallet immediately; recovery phrases stored on the infected device may already be stolen
- 5 Contact your bank if you notice any unauthorised transactions
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ Any CAPTCHA or 'security check' that tells you to press Windows+R, Ctrl+V, and Enter — legitimate CAPTCHAs never ask you to run commands
- ⚠ The page may show a Cloudflare logo, a Microsoft logo, or a spinning 'verifying your browser' animation to appear legitimate
- ⚠ A brief black command window flashes and closes after you follow the steps — that is the malware (Vidar Stealer) running silently
- ⚠ On Mac: a page tells you to open Terminal and paste a command to prove you are human
- ⚠ You did not consciously download any file, yet something may have run in the background
- ⚠ The compromised page is often a real, legitimate Australian business website — so the domain looks safe
Sources
- ASD ACSC — ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure (May 2026)
- SBS News — 'Now measured in the millions': The common process being used to scam Australians
- Bitdefender — ClickFix Campaign Uses Compromised WordPress Sites to Spread Vidar Stealer in Australia
- Cyber Daily AU — ACSC warns of ClickFix campaign leveraging Australian infrastructure