The paste-to-continue scam (ClickFix): how to spot it

One of the most effective scams right now doesn’t rely on a dodgy attachment or a cracked password — it relies on tricking you into running the attacker’s command yourself. It’s known as “ClickFix,” and it usually appears as a “paste this to continue” or fake “verify you are human” step. Here’s how to recognise it and what to do.

How the scam works

You land on a web page — often a normal business website that has been quietly compromised — and see a message such as “Verification failed, press the keys below to continue” or a fake CAPTCHA. It asks you to:

1. Press the Windows key + R (which opens the Run box), or open a terminal.
2. Press Ctrl + V to paste (the page has secretly copied a command to your clipboard).
3. Press Enter.

Those three steps run a hidden command that downloads and installs malware. Because you ran it, many security tools treat it as a trusted action, which is exactly why the trick works.

Warning signs

• Any web page that asks you to press Windows + R, open PowerShell or a terminal, or paste something to “fix,” “verify” or “continue.”
• A “CAPTCHA” that gives keyboard instructions instead of asking you to click images.
• Instructions to disable antivirus or ignore a security warning.
• Urgency: “do this now or lose access.”

What to do

• Never paste a command into Run, PowerShell or a terminal because a web page told you to. Legitimate websites never ask for this.
• Close the tab. Do not follow the steps.
• If a command was already run, disconnect the device from the network and contact your IT support (or Techloom) straight away — the sooner it’s contained, the better.
• Tell your team. Awareness is the best defence against this specific trick.

If you run a website

These campaigns spread by compromising legitimate sites — often on WordPress or PrestaShop — and injecting the malicious script. Keep your platform, themes and plugins updated, remove unused plugins, and have your site checked for injected scripts or unknown files so your own visitors aren’t targeted.

How Techloom can help

Techloom helps small and medium businesses reduce this kind of risk with practical staff awareness, sensible endpoint protection, and checks of the systems and websites you rely on. Request a cybersecurity and network audit or get in touch.

Background reading: security researchers at Netskope Threat Labs and Cisco Talos have documented ClickFix campaigns in detail. Guidance here is general awareness, not a substitute for advice tailored to your environment.