ClickFix Fake CAPTCHAs Trick Staff Into Running Malware Through the Windows Run Dialog

Huntress describes a near miss involving one of its own employees, who was waiting at an airport and clicked through to a spa listed on the airport's website. The page looked genuine, used a normal domain with HTTPS, and triggered no browser warnings. A CAPTCHA then asked her to complete "verification steps", including pressing Windows key + R and then Ctrl + V. Those keystrokes would have opened the Windows Run dialog and pasted a malicious PowerShell command that the page had quietly copied to her clipboard.

Had she pressed Enter, the command would have downloaded and run a file that sets up persistence through a registry key, installs a remote access trojan, and steals saved browser passwords, cookies and credit card details. She recognised the trick and stopped. Huntress notes that many people do not. This technique is known as ClickFix: a social engineering attack that persuades users to run commands they do not understand, often by framing it as a fix for a problem.

The approach is effective. Huntress's 2026 Cyber Threat Report linked ClickFix and fake CAPTCHA scams to over half of all malware loader activity, and in its own SOC, ClickFix-style Run dialog attacks account for 31% of EDR SOC signals. Lures keep changing, from fake Windows Update screens and fake Docker ads to compromised small-business websites and malicious AI chatbots, but the classic version usually ends with Windows key + R. That shortcut is mainly used by IT staff, and most employees have never opened it on purpose.