A member of staff is trying to open a document, watch a video, or get past a download page. A box appears that looks exactly like the “verify you’re human” check everyone clicks a dozen times a week: the same Cloudflare or Google reCAPTCHA branding, the same tickbox, the same air of harmless routine. This one carries instructions. Press the Windows key and R together, then Ctrl and V, then Enter. They follow along, a small window flickers and vanishes, and the page says verification is complete. They get on with their day. What they’ve actually done is open the Windows Run dialog and execute a command the website had already copied to their clipboard without them seeing it. Nothing looks wrong at the time. A week later the finance mailbox is sending invoices nobody wrote, or the passwords saved in the browser are being used from an address in another country.
That attack is called ClickFix, and it’s one of the fastest-growing things we’re watching in 2026. It’s worth understanding for two reasons: it walks straight past most of what an SME has already paid for, and the defence is unusually simple once you know what you’re looking at. It’s also the clearest current example of a wider family of attacks, which this piece comes back to.
What ClickFix actually is
ClickFix is a piece of social engineering dressed up as a security check. The page shows a fake CAPTCHA, and behind it a small script silently copies a command onto your clipboard. The “verification steps” (Windows+R, then Ctrl+V, then Enter) are just instructions to open the Run dialog, paste that command, and run it. The command is usually PowerShell (the scripting tool built into every copy of Windows) or a similar built-in utility, and its job is to reach out to the internet and pull down the actual malware.
The clever, and genuinely nasty, part is that it turns the person into the delivery mechanism. The steps are disguised as a CAPTCHA precisely because everyone is trained to complete those without thinking. There’s a Mac version too, which asks the user to paste into Terminal instead.
Why it slips past the tools you’ve paid for
Most SME security spend assumes the threat arrives as a file or a link. ClickFix arrives as a set of instructions, and the user carries them out willingly, which is why so many controls never get a vote.
There’s no malicious attachment in an email for your filter to quarantine, and no suspicious download for the browser to block, because the payload is fetched by a command the user chose to run. The command uses a legitimate, signed Windows tool, so it doesn’t trip the simple “is this a known virus” checks. And the fake CAPTCHA often sits on a real, reputable website that’s been compromised, so the usual “is this a dodgy site” reputation checks come back clean. One May 2026 campaign reported by Malwarebytes hijacked more than 700 education and technology websites to serve exactly this lure.
What it actually drops
The command pulls down an infostealer or a remote-access trojan (a RAT, malware that gives an attacker hands-on control of the machine). The families being seen most often include Lumma Stealer, NetSupport RAT, DarkGate and AsyncRAT, with the Atomic stealer on the Mac side.
The first prize is almost always credentials: the passwords saved in the browser, active session tokens, anything that opens the email, the finance system, or the cloud admin console. From there it becomes invoice fraud, a quiet takeover of the mailbox, or a foothold sold on to a ransomware crew weeks later. The malware on the laptop is only the start of the story.
How big this has become
This is not a fringe technique aimed only at large enterprises. The lures are scattered across ordinary websites, which means a small business is about as likely to meet one as anybody else.
Microsoft’s threat team tracked CAPTCHA-gated phishing more than doubling in March 2026, the highest volume they’d recorded in over a year. The technique has spread fast enough that the US Federal Trade Commission put out a fresh public warning about fake CAPTCHAs in June 2026. When the consumer regulator and the platform vendor are both flagging the same trick in the same quarter, it has stopped being a curiosity.
The one thing to teach everyone
Here is the part worth pinning to the wall, because it defeats the whole technique on its own.
A genuine CAPTCHA never asks you to leave the browser. It keeps you on the page: ticking a box, typing a few characters, picking out the buses. The moment a “verification” step tells you to open the Run dialog, paste something, or run a command, it isn’t a CAPTCHA and it isn’t a fix. It’s an attack, and the right response is to close the tab and report it. That one sentence, genuinely understood by everyone in the business, is the highest-value control you have here, because the attack cannot proceed without a person choosing to act.
The same trick in a different costume
ClickFix is the loudest example right now, but it belongs to a family, and the family is the thing worth recognising. The shared idea is simple: instead of smuggling a file past your defences, the attacker persuades a person to run, install, or enable the thing themselves. Once the user does it on purpose, most of the controls you’ve paid for never get a say.
Three cousins we see reaching SMEs, none of which we’ve written up here before:
Fake software updates. You’re on an ordinary website and a banner insists your browser, or a video plug-in, is out of date and must be updated to carry on. The “update” is the malware. This one, often called SocGholish or FakeUpdates, lives on legitimate but compromised sites, exactly like ClickFix.
Poisoned downloads. Someone searches for a familiar tool, AnyDesk, Zoom, a PDF reader, and clicks the top result, which is a paid advert or a gamed search listing pointing at a near-perfect clone of the real download page. The installer runs, the app even opens, and an infostealer rides in beside it.
The phone-call version. An email arrives with no link and no attachment, just a notice that a subscription is about to auto-renew for a few hundred pounds and a number to call if you want to cancel. The helpful person on the line walks the caller through installing a remote-support tool, and now a stranger has hands on the machine. It beats the email filter precisely because there’s nothing in the email to catch.
The specifics differ, so the ClickFix “never leave the browser” line doesn’t map word for word. The broader version that does is worth saying out loud to the team: be wary any time a web page, a pop-up, or a caller wants you to install, run, update, or enable something in order to proceed. That instinct covers the whole family.
What we put around it for clients
Awareness is the centre of gravity, but it isn’t the only layer, and the same set of measures covers the whole family, because every one of these attacks funnels through one moment: a person about to run something. Inside our Security Solutions practice, this is the shape of it.
The brief comes first: five plain lines to the whole team about that single red flag, refreshed often enough that it sticks. Then we lock the door the attack actually uses. Most staff have no day-to-day need for the Run dialog or for PowerShell, so we restrict or constrain them with Group Policy, AppLocker (the app-control feature built into Windows) and PowerShell Constrained Language Mode, which means a pasted command won’t run even if someone is talked into trying. We make sure the endpoint software is watching for the behaviour rather than the file, because decent EDR (endpoint detection and response, security software that spots malicious behaviour instead of known virus signatures) can flag the tell-tale chain of a browser launching PowerShell that immediately calls out to the internet. We make the stolen prize worth less, with phishing-resistant MFA, short session lifetimes, and a password manager in place of browser-saved logins, so a successful theft hands the attacker far less than it used to. And we give people a no-blame way to report it, so the person who realises mid-paste that something feels off says so straight away instead of hoping it was nothing.
None of that is exotic, and most of it is configuration on tools an SME already owns rather than a new line on the budget.
Where this lands with us
ClickFix sits squarely in our Security Solutions practice. For managed clients we hold all of the above: the staff briefing, the device lockdown, the detection tuning, and the incident response if something does land. For self-managed clients we’ll run the briefing and the device-hardening work and leave you a clean report route to use.
If you’re not certain whether a command pasted into the Run box could actually execute on your team’s machines today, that’s exactly the kind of gap our free 30-minute health check is built to surface. It’s our Security Solutions practice, and you can start by dropping a note to info@jmopartners.co.uk. One of us will read it.
JMO|Partners · Enterprise IT, sized for SMEs.