Fake “I’m not a robot” checks: when a CAPTCHA becomes a scam
A real human-verification check confirms that a person is using a website. A fake page may copy its appearance to make you open a system tool and run a command. This social engineering technique is called ClickFix.
What exactly did you do on the page?
Risk depends on the step you took. Seeing a page is different from manually running a command in your operating system.
I only saw the fake check
You saw the page but copied and ran nothing.
View the steps →I clicked “I’m not a robot”
You clicked but did not open Run, PowerShell or a terminal.
View the steps →I pasted a command but believe it did not run
You pasted content into a system tool. If you are unsure whether it executed, follow the steps for a command that ran.
View the steps →I have already run the command
The command executed and your device may have downloaded or run further code.
Open urgent response steps →How a fake human check leads to running a command
The scammer makes the process look like a routine security step, then moves you from the browser to a system tool.
You reach a page
The link may come from an email, advert, search result or compromised legitimate website.
A CAPTCHA or error appears
“Verify you are human”, “I’m not a robot” or a fake technical error.
The page prepares a command
Clicking may secretly copy a malicious command to your clipboard.
Instructions to use Win + R
The site tells you to open a system dialog or another tool.
You are told to use Ctrl + V
You are pasting a command prepared by the page, not a CAPTCHA confirmation.
The command runs further code
Possible consequences include malware downloads, stolen credentials or remote control of your device.
A fake check can become a malware installation
What a real CAPTCHA can do — and what should make you stop
The checkbox’s appearance or logo is not decisive. What matters is what the page asks you to do.
Normal verification
- Takes place within the website.
- May ask you to tick a box.
- May ask you to select images.
- May happen automatically.
- Does not open system tools.
- Does not ask you to run commands manually.
Fake verification
- Asks you to press Win + R.
- Asks you to open PowerShell or a terminal.
- Asks you to paste content with Ctrl + V.
- Asks you to execute a command.
- Claims this is “manual verification”.
- Makes you leave the browser.
It is not limited to “I’m not a robot”
The same technique can hide behind a fake error, update or security warning. The common feature is persuading you to run a system command yourself.
“I’m not a robot”
Fake CAPTCHA or “Verify you are human” prompt.
“The document could not load”
You supposedly need to repair the system manually.
“Update your browser”
The site claims a critical component or update is missing.
“Fix a Windows error”
You are told to copy and run a prepared command.
“Verify your account”
The scam imitates a familiar service or institution.
“Alternative verification”
A normal CAPTCHA is followed by another supposedly essential manual step.
Scammers exploit trust in routine technical tasks
ClickFix relies on psychology and the expectation that a routine “check” or “repair” is safe.
Routine behaviour
People are used to completing CAPTCHAs automatically without questioning each step.
Technical authority
Instructions look as if they come from the operating system or a familiar service.
The user starts the attack
The dangerous step is not always a conventional file downloaded automatically.
The clipboard hides the actual content
You may not know exactly what command Ctrl + V pasted into the system.
What may happen after the command runs
The outcome depends on the code. Do not assume that only one particular threat is involved.
Password theft
Credentials saved in the browser or operating system.
Cookie and session theft
The attacker may try to misuse sessions that are already signed in.
Email access
Email can be used to reset other accounts and passwords.
Cryptocurrency information
Wallets, browser extensions or exchange accounts may be at risk.
Remote control of the device
Downloaded code may enable further access or control of the computer.
Further malware
The command may download additional harmful components.
Stop when a website sends you to system tools
Win + R
A CAPTCHA has no reason to open the Run dialog.
Ctrl + V outside the browser
The site tells you to paste unknown content into your system.
PowerShell
Manually running a command is not part of a normal CAPTCHA.
Windows Terminal
Human verification does not require a terminal.
Command Prompt
Technical instructions move you outside the website.
Installing an unknown program
The page asks you to download a tool or “repair” app.
Unexpected manual verification
A routine web check turns into system instructions.
The website makes you leave the browser
Verification continues in system tools.
The principle matters more than the keyboard shortcut
ClickFix campaigns have also targeted macOS users. Instructions can be adapted to the operating system.
What to do at each stage
What matters is whether you only saw the page, clicked a button, pasted a command or actually ran it.
I only saw the page
- Do not copy anything.
- Do not paste anything into system tools.
- Close the page.
- Do not reopen the suspicious link.
- You can report the suspicious page.
I clicked “I’m not a robot” but did nothing else
- Close the page.
- Do not use clipboard content from that page.
- Do not paste anything into Run, PowerShell or a terminal.
- Do not download any “repair” tools.
- Clicking alone does not necessarily mean malware has run.
I pasted a command but believe it did not run
- If the command definitely has not run, remove it without executing it.
- Close the dialog or terminal.
- Do not press Enter. Pasting into a terminal can sometimes execute commands automatically; if unsure, treat the command as executed.
- Close the page.
- Run a security scan as a precaution.
I have already run the command
- Disconnect the device from the internet.
- Do not use it for banking, email or password changes.
- Change priority passwords from another safe device.
- End active sessions on important accounts.
- Arrange a full security assessment; if you are unsure how, get trusted technical help. A clean scan alone cannot guarantee safety.
- Check unfamiliar programs, accounts and active sessions.
- If banking credentials or payment details may have been exposed, contact your bank from a safe device.
- If you discover loss or misuse, contact your local police.
Do not carry on working after running an unknown command
If you do not know what the command did, consider the device potentially compromised. Change important passwords from another safe device and obtain technical help if needed.
What to keep
Documentation can help an investigation, but never run anything again just to collect evidence.
Page URL
The exact address of the suspicious page and how you reached it.
Screenshot of the fake CAPTCHA
Page appearance, verification text and displayed instructions.
Instruction text
Exactly what the page told you to do.
Command as text
Only if it remains safely available without executing it again.
Time of the event
Date and approximate time of clicking, pasting or execution.
New files or programs
Names of new files, installations or suspicious processes.
Fake human checks and ClickFix — FAQ
Is every “I’m not a robot” check dangerous?
No. CAPTCHA is a common security mechanism. The warning sign is being asked to leave the browser and manually run a system command for verification.
Is clicking a CAPTCHA already dangerous?
Clicking does not necessarily execute malware. In ClickFix, it may prepare a command in your clipboard. Pasting and running that command is the critical further step.
What is ClickFix?
A social engineering technique in which a website uses a CAPTCHA, error repair or technical check as a pretext to make you run a prepared command manually.
Why does the scam ask for Win + R?
The Run dialog lets you start a command manually. The scammer wants you to execute content prepared by the website yourself.
Can a legitimate website be compromised too?
Yes. ClickFix prompts can appear on compromised legitimate sites. A trusted website name is no reason to follow unusual system instructions.
What if I pasted the command but did not run it?
Do not press Enter. Remove it and close the dialog. Terminal pasting can sometimes execute a command automatically; if unsure, follow the executed-command steps. Run a security scan as a precaution.
What if I ran the command?
Disconnect the device, avoid sensitive services on it, change priority passwords from another safe device and arrange a full security assessment. Get trusted technical help if needed.
Does ClickFix also affect macOS?
Yes. The same method can be adapted to another operating system. The rule is unchanged: a website should not require manual system commands just to verify that you are human.
Have you found a fake human check or ClickFix page?
Keep the URL, screenshot and instructions. Reporting to DPP does not replace a device assessment, contacting your bank or reporting a crime to police. DPP’s report form is currently in Czech.