Is CAPTCHA Still Safe? Inside the Emerging ClickFix Scam

Preface

You have probably clicked "I am not a robot" many times without a second thought, but since the end of 2025 a new attack called ClickFix has been spreading worldwide. Attackers forge a near‑identical CAPTCHA page and lure users into executing malicious code, effectively handing a backdoor to the attacker while the victim believes they are merely proving they are human.

1. From CAPTCHA to Weapon: What ClickFix Is

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is meant to separate humans from bots. Services like Google reCAPTCHA and Cloudflare Turnstile are ubiquitous. ClickFix’s cleverness lies in not attacking the CAPTCHA system itself but exploiting users’ conditioned trust in CAPTCHA prompts.

Attackers host a spoofed page that looks exactly like mainstream CAPTCHAs. The page shows a prompt such as "Please complete verification to continue." After the user clicks, the page asks them to press Win + R to open the Run dialog and paste a "verification string"—actually a PowerShell or mshta command that downloads and runs a remote‑access trojan (RAT).

Every step is performed voluntarily by the user. No browser vulnerability is needed, no zero‑day is triggered, and many antivirus products fail to block it because the execution is user‑initiated.

2. Full Attack Chain Technical Breakdown

A typical ClickFix execution flow proceeds as follows:

Key technical points:

Clipboard hijacking is the core. The attacker uses the navigator.clipboard.writeText() API to write a crafted command to the clipboard when the user clicks the "I am not a robot" button. This API works on HTTPS pages during user interaction without additional permission prompts, leaving the user unaware of the clipboard tampering.

Payload delivery has evolved. Early ClickFix variants downloaded an executable file; modern variants perform "file‑less" attacks—PowerShell scripts decode in memory and reflectively load a .NET assembly, evading static scans by antivirus software.

3. Why Traditional Defenses Fail

ClickFix is dangerous because it hands the most critical step—executing malicious code—to the user. This defeats several layers of conventional protection:

1. Email gateway/URL filtering: Partially effective, but attackers frequently rotate domains or host spoofed pages on legitimate platforms such as Google Sites or Notion, making reputation‑based detection difficult.

2. Browser sandbox: Ineffective. The attack does not exploit a browser vulnerability; the user runs the command at the OS level, which the sandbox cannot contain.

3. Antivirus/EDR: In theory they can block malicious PowerShell behavior, but many variants use multi‑layer Base64 encoding, string concatenation, and environment‑variable obfuscation to bypass AMSI. Moreover, user‑initiated actions often receive a lower risk score from behavior‑based models.

4. Security awareness training: Most corporate training only warns against clicking suspicious links. ClickFix pages look so authentic that even security professionals may hesitate—"Is this really a Cloudflare verification?"

4. Real‑World Cases in Early 2026

Case 1: Fake Booking.com hotel‑industry attack (March 2026) Attackers emailed European hotel front‑desks pretending to be Booking.com reservation confirmations. The link led to a counterfeit Booking login page that displayed a Cloudflare‑style CAPTCHA. After completing the verification, the hotel’s management system credentials were stolen by the Lumma Stealer, allowing attackers to log into the real Booking backend and launch phishing campaigns. Over 200 hotels were affected.

Case 2: GitHub fake Issue poisoning (May 2026) Attackers mass‑submitted issues to popular open‑source projects claiming a “security vulnerability” and providing a “PoC reproduction page.” Developers clicking the link saw a verification page that required command‑line execution. Several maintainers lost their GitHub Personal Access Tokens and npm publishing rights.

Case 3: Tax‑season phishing in China (January‑April 2026) A ClickFix variant impersonated the national e‑tax authority, prompting users to run a PowerShell command for “manual verification.” The timing coincided with individual tax filing, leading to internal credential leaks in multiple enterprises.

5. Mitigation Strategies: Deployable Technical Replacements

Since traditional CAPTCHAs have become a vector for social‑engineering attacks, 2026 defenses must shift from "verifying human identity" to "eliminating risky user actions." Viable paths include:

1. Passkey replaces CAPTCHA Under the FIDO2/WebAuthn standard, Passkey authentication is fully deployed on Apple, Google, and Microsoft platforms. Users authenticate with fingerprint or facial recognition, eliminating any need to copy text, open a terminal, or run scripts. Even a forged page cannot replicate the biometric flow. Cloudflare began testing Passkey‑based Turnstile in Q2 2026.

2. Browser‑level clipboard protection Chromium 128 (released end of 2025) blocks navigator.clipboard.writeText() unless the user explicitly authorizes it. Firefox and Safari are adopting similar policies, cutting off the clipboard‑hijack stage of ClickFix. Enterprises can enforce this restriction via browser configuration policies.

3. Endpoint behavior‑chain detection Traditional EDR looks at isolated events (e.g., PowerShell executing a Base64 command). ClickFix exhibits a chain: browser writes to clipboard → user opens Run window → pastes and executes → script initiates outbound traffic. Major EDR products in 2026 (CrowdStrike Falcon, Microsoft Defender for Endpoint) now support behavior‑chain rules that raise high‑confidence alerts for this sequence.

4. AI semantic phishing page detection Conventional phishing filters rely on URL reputation and visual similarity. ClickFix attackers host pages on legitimate CDNs (Cloudflare Workers, Vercel, Netlify), bypassing URL checks. In 2026, multi‑modal large models analyze page content semantically: any page that combines "CAPTCHA" UI elements with instructions to run system commands triggers a strong anomaly signal. Google Safe Browsing integrated this capability in 2026.

6. Quick Guidance for End Users

The simplest rule to spot a fake CAPTCHA:

If any verification page asks you to open the Run dialog, a terminal, or paste and execute commands, it is fraudulent.

Legitimate CAPTCHAs only require clicking, dragging, or selecting images—never executing system commands. Remember this, and you can avoid most ClickFix attacks.

If you encounter a suspicious page in an enterprise setting, do not dismiss it. Capture a screenshot, preserve the URL, and report it to your security team, as your encounter may indicate that a colleague has already been compromised.

This article is compiled from publicly available threat intelligence and security vendor reports, with data up to August 2026.