What are the red flags of this scam?

A CAPTCHA or security check that asks you to press keyboard shortcuts like Windows+R, Ctrl+V, and Enter — real CAPTCHAs never ask you to run commands • The page may display a Cloudflare, Microsoft, or 'government security' logo to appear legitimate • A brief black command window flashes and closes after you follow the steps — that is the malware installing itself • You did not download anything explicitly, yet something may have run in the background after following the 'verification' steps

What should I do if this happened to me?

If you have not yet pressed the keys: close the browser tab immediately — do not complete the CAPTCHA instructions • If you already pressed Enter: disconnect from the internet immediately, then run a full antivirus or anti-malware scan before reconnecting • Change your passwords for email, banking, and crypto accounts from a separate, clean device • If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it. • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

CRITICAL phishing Last reported: Oct 13, 2026 Share

Fake security-check CAPTCHAs trick you into pressing keyboard shortcuts that install malware

Q: Is this a scam?

Yes. This is a documented scam pattern. A fake CAPTCHA or "security verification" page tells you to press Windows+R, Ctrl+V, then Enter — secretly running malware already copied to your clipboard. It steals passwords, banking logins, and crypto wallet credentials.

A fake CAPTCHA or "security verification" page tells you to press Windows+R, Ctrl+V, then Enter — secretly running malware already copied to your clipboard. It steals passwords, banking logins, and crypto wallet credentials.

Also known as: ClickFix scam, fake Cloudflare CAPTCHA, keyboard command malware, PowerShell clipboard attack

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

What to do right now

1 If you have not yet pressed the keys: close the browser tab immediately — do not complete the CAPTCHA instructions
2 If you already pressed Enter: disconnect from the internet immediately, then run a full antivirus or anti-malware scan before reconnecting
3 Change your passwords for email, banking, and crypto accounts from a separate, clean device
4 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
5 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Was remote-access software installed?

If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.

Run SeraphSecure to detect and remove it →

Red flags

⚠ A CAPTCHA or security check that asks you to press keyboard shortcuts like Windows+R, Ctrl+V, and Enter — real CAPTCHAs never ask you to run commands
⚠ The page may display a Cloudflare, Microsoft, or 'government security' logo to appear legitimate
⚠ A brief black command window flashes and closes after you follow the steps — that is the malware installing itself
⚠ You did not download anything explicitly, yet something may have run in the background after following the 'verification' steps

Known variants

Traffic Distribution Systems (TDS) silently route clicks from poisoned search ads or hijacked website links to ClickFix fake-CAPTCHA pages or credential-phishing portals without the user seeing a redirect. FBI PSA260618 warns TDS is now a primary delivery chain for both malware payloads and phishing. (IC3 warning Jun 18, 2026.)

Last seen: 7/26/2026
ClickLock (macOS): fake Cloudflare page says to open Terminal and paste a command. Script kills all apps, freezes the Mac, then shows a fake macOS password dialog. Exfiltrates Keychain, 1Password, Bitwarden, MetaMask, browser creds; installs backdoor. Group-IB / Malwarebytes Jul 2026.

Last seen: 7/26/2026
MyChart medical phishing: fake email claims alarming test results are waiting in MyChart. The fake portal collects your login, shows fabricated bloodwork warnings, then triggers a ClickFix 'human verification' step (Windows+R, paste, Enter) that installs an infostealer. Epic / AHA warning Aug 2026.

Last seen: 9/2/2026
Fake Chrome update popup: compromised sites display a banner claiming your browser is dangerously out of date. Clicking 'Update' installs malware or a weaponized Chrome extension. One extension with 70,000 users was turned malicious after its developer sold it. Stolen: passwords, cookies, crypto wallet credentials. Sep 2026.

Last seen: 9/12/2026
Fake streaming service ads on Reddit and social media: malicious sponsored posts impersonating HBO Max, Netflix, or Spotify drive victims to a spoofed page that runs a ClickFix fake-CAPTCHA step. Victims trust the brand and the ad platform context. McAfee Sep 18, 2026 identified this vector.

Last seen: 9/18/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources