You are browsing the website of a local clinic or a plumbing company you have used before. The page blurs. A familiar box appears: “Verify you are human.” You have done this a thousand times.

But this verification does not want a click. It shows a string of text, tells you to copy it, press Win+R, paste it into the box that opens, and press Enter — all “to complete the verification.” On a Mac, the instructions say to open Terminal, or in newer variants, Script Editor.

The moment you press Enter, you have installed malware on your own machine, with your own permissions, using your own hands. That is the whole trick. It is called ClickFix, and in 2026 it became one of the dominant ways attackers reach victims — including crypto users whose wallets are the end goal.

How the ClickFix trick works, step by step

The mechanics matter less than the psychology, but the mechanics are worth seeing once:

  1. You land on an infected page. Often this is a legitimate website that was compromised — not a shady domain. In the campaign Netskope documented starting in spring 2026, the infected sites were mostly small-business websites running WordPress or PrestaShop: clinics, trailer dealers, radiology centers, e-commerce shops. How they were initially compromised is still unknown.
  2. A fake CAPTCHA overlay appears, usually blurring the page behind it. Many variants copy the visual style of Cloudflare’s verification pages, because that is what people are used to trusting.
  3. The prompt “helpfully” copies a command to your clipboard (or shows it in a copy box). It then instructs you to open the Windows Run dialog with Win+R, or PowerShell, or on macOS the Terminal — and paste.
  4. The pasted command is a downloader. It fetches the real payload from attacker infrastructure and executes it. Some variants immediately clean up after themselves: the Huntress-documented macOS chain deleted its temporary files, cleared the Terminal window, and wiped shell history so there was no visible trace of what ran.

Every step after the fake CAPTCHA is performed by you, voluntarily. There is no attachment for an email scanner to flag, no downloaded file for antivirus to quarantine in many variants — LevelBlue’s analysis of related campaigns found the chain executes almost entirely in memory. The attacker’s insight is brutal: the most reliable way past every security product is to have the victim type the attack themselves.

The 2026 scale: 5,400 hacked sites and an on-chain dead drop

In research published on September 2, 2026, Netskope Threat Labs described the infrastructure behind a massive ongoing ClickFix distribution network:

  • More than 5,400 compromised websites across more than 2,200 organizations, worldwide, with no shared industry or region — mostly small businesses.
  • Several hundred of those sites were active on any given day, more than 300 each weekday; August peaked at 536 distinct sites in a single day contacting the malicious endpoints.
  • The injected code on each site did not carry the payload itself. Instead it made a JSON-RPC eth_call to a smart contract on the BNB Smart Chain testnet, retrieved the next-stage script stored on-chain, and ran it in your browser.

That last part deserves a pause, because it is the reason this campaign is so hard to kill. Storing attack code in a blockchain smart contract — a technique researchers call EtherHiding, first seen in the 2024 ClearFake fake-browser-update campaigns — turns the chain into a dead drop:

  • The operator updates one contract, and every one of the 5,400 sites serves the new payload on the next page load. No need to rehack thousands of sites.
  • BSC testnet works like mainnet but its tokens are free from faucets, so running this distribution layer costs the attacker nothing.
  • There is no host or registrar that a takedown request can reach. The chain just keeps serving the code.

For crypto users this is an uncomfortable inversion: the same property that makes blockchains censorship-resistant — nobody can take the data down — is being used as malware delivery infrastructure. BleepingComputer’s coverage of the campaign walks through the same chain with the on-chain storage front and center.

Netskope also found a variant that skips the fake CAPTCHA entirely: the on-chain script opens an encrypted WebRTC data channel back to the attacker and runs whatever comes through it — a command-and-control channel that ordinary HTTP proxies do not inspect.

Why crypto wallets are the target

ClickFix is not crypto-specific — it also delivers ransomware and general credential theft — but several of the observed payloads are aimed squarely at wallets. In LevelBlue’s multi-month analysis of fake-CAPTCHA delivery chains, the final payload rotated between commodity infostealers (StealC, Lumma, Rhadamanthys, Vidar, Aura) and one payload that matters especially to anyone who sends transactions: a cryptocurrency clipboard hijacker.

Here is what that means in practice:

  • Infostealers sweep browser password stores, cookies, and saved wallet-extension data. If your seed phrase has ever lived in a file, a screenshot, a password manager note, or an browser extension vault on that machine, the stealer’s file-pattern scan is designed to find it. Once the seed phrase is exfiltrated, the attacker does not need your computer anymore — they import the wallet themselves. Hardware wallets do not save you here: the theft happened at the moment the phrase passed through the infected machine, before the hardware wallet was ever involved.
  • Clipboard hijackers watch your clipboard. You copy a wallet address, the malware swaps it for an attacker-controlled lookalike in the split second before you paste, and you send funds to the wrong address after “carefully” pasting it. This is the same endgame as address poisoning, executed by malware instead of by spoofed transactions in your history.
  • Wallet drainers with a throttle. The most instructive case comes from Huntress, who responded to an incident where a Mac user pasted a ClickFix command into Terminal. The final payload was a Go-based stealer that harvested browser passwords and macOS Keychain data — and contained a function named DRAIN that could query a wallet’s balance on-chain and redirect a configurable percentage of it (a DRAIN_PCT variable) to attacker-controlled addresses, across Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP. Huntress noted it was the first wallet-draining malware they had analyzed capable of taking less than the full balance. Skimming a few percent at a time is a deliberate design: the victim does not notice, and the wallet keeps refilling.

The full chain for that Mac case — the fake prompt, the fake password dialog, the persistence tricks, and the sanctioned bulletproof hoster behind it — is documented in Huntress’s writeup. The infrastructure traced to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US in July 2025 and later jointly by the UK and Australia.

Why smart people fall for it

The fake CAPTCHA works because it weaponizes three things at once:

  • Habit. You have verified your humanity thousands of times. Verification prompts no longer register as a security decision; they register as friction between you and the page.
  • A legitimate context. The prompt appears on a real small-business website, or in Guardio’s documented cases, inside phishing emails impersonating brands like Booking.com. Some campaigns even hosted the fake CAPTCHA flow on script.google.com — a real Google subdomain that security tools are reluctant to block.
  • A plausible story. “Press Win+R to verify” sounds odd when you read it cold, but the dialog dresses it up as a step you simply have not done before. The command is pre-copied. Every micro-decision is made for you.

Guardio’s research on the fake-CAPTCHA ecosystem tracked how this format outcompeted and effectively replaced the older fake-browser-update scam: no download prompt, no scary warning screens, just a familiar check with one extra step. That is why ClickFix moved from a niche red-team trick to the initial access vector of choice for operations ranging from stealer delivery to ransomware.

How to protect yourself

The defense is behavioral, and it is binary:

  • A real CAPTCHA will never ask you to open Run, PowerShell, Terminal, or Script Editor. No legitimate verification needs you to paste a command. This single rule defeats every variant above, including future ones.
  • Close the tab if a page tells you to paste a command. If you are worried the site is genuinely broken, revisit it later from a bookmark.
  • Do not trust “familiar site = safe site.” The 5,400 sites in this campaign were legitimate businesses whose servers were compromised. Site reputation does not protect you from an injected script.
  • If a pasted command has already run, treat the machine as compromised regardless of how fine it looks: the Huntress macOS chain deliberately erased its own traces. Move funds from any wallet whose seed phrase ever touched that machine — sweep to a freshly generated wallet on a clean device — and change passwords from a different computer. Our first-24-hours guide covers the full triage sequence.
  • Check where wallet addresses actually go. A hardware wallet’s screen is the one place a clipboard hijacker cannot rewrite — verify the first and last characters of every address on the device itself, not on the computer.

If you want the underlying concepts in more depth, see our explainers on clipboard hijacking, phishing attacks, social engineering, and seed phrase security. ClickFix is also a cousin of the signature scam pattern — both attacks get you to authorize something yourself, which is exactly why they bypass technical defenses — and of the fake airdrop-claim drainers that use fake websites instead of fake verification prompts.

This article is educational and not financial or security advice. Incident details are drawn from the linked first-party research from Netskope, Huntress, LevelBlue, and Guardio.

Frequently Asked Questions

Can antivirus catch ClickFix malware?

Often not at the moment of infection. The pasted command executes with your privileges, and many chains run fileless — in memory — leaving few artifacts for signature-based tools. Some macOS variants strip the quarantine attribute specifically to avoid Gatekeeper warnings. Behavioral defenses and the "never paste a command" rule do more work here than scanners.

Is my hardware wallet safe if my computer is infected?

The hardware wallet protects signing, but not secrets that were exposed on the computer. If your seed phrase was ever typed, stored, screenshotted, or autofilled on the infected machine, assume it is compromised and move funds to a new wallet generated on a clean device. If the phrase never touched the computer, the device's own address confirmation is your defense against clipboard swaps — use it.

Why do attackers put malware code on a blockchain?

Takedown resistance and cheap central management. A smart contract on BSC testnet is free to deploy and update, and no hosting provider or registrar can remove it. Updating one contract updates every compromised website pulling from it — the chain acts as the campaign's shared hard drive.

What should I do if I already pasted the command?

Disconnect the machine from the network, do not enter any passwords on it, and move crypto to a freshly generated wallet from a different device. Rotate stored passwords from a clean machine, not the infected one. Deleting the visible malware files is not enough to undo credential theft that already happened.