GoKawiilClickFix scam using fake CAPTCHAs spreads rapidly across PCs and Macs
Security researchers report that ClickFix, a malware technique relying on fake CAPTCHA prompts and terminal commands, has exploded in popularity among attackers, including state-backed hacking groups. The attack tricks victims into copying and pasting a malicious command into Windows Run, PowerShell, or macOS Terminal after clicking through a fraudulent verification screen on a compromised website.
GoKawiil's interpretation of the reporting above, not reported fact.
The scheme succeeds because everyday users have grown numb to confusing website prompts and repetitive verification steps, making a malicious command paste feel like just another routine annoyance. Its cross-platform reach and adoption by sophisticated threat actors signal that ClickFix has moved from a niche trick to a widespread infection vector affecting ordinary internet users everywhere.
- ClickFix attacks now target both Windows and macOS users via compromised legitimate websites.
- The technique relies on fake CAPTCHA overlays that trick users into running malicious terminal commands.
- State-sponsored hacking groups have begun adopting ClickFix, showing its growing credibility as an attack method.
Malwarebytes Premium Security — ClickFix scams trick people into pasting malicious commands, so a second layer of real-time protection is worth having on both PCs and Macs. Malwarebytes Premium runs alongside your system defenses and can flag and remove malware payloads that sneak in through compromised websites. It's an easy safety net for family members who aren't scrutinizing every fake CAPTCHA prompt.
See Malwarebytes Premium Security on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-11
Published there as: “ClickFix attacks infecting PCs and Macs are going viral”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.