A website asks you to press Windows+R and paste? Stop.
Fake “verify you’re human” pages trick people into running malware themselves. It’s called ClickFix, and it’s very common.
- A real CAPTCHA never asks you to open the Run box, Terminal or PowerShell, or to paste anything.
- Clicking “Verify” on these pages secretly copies a malicious command to your clipboard. The next step asks you to press Windows+R, Ctrl+V and Enter.
- On a Mac, the same trick asks you to paste into Terminal and then keeps asking for your password.
- They turn up on hacked websites, in malicious ads and in phishing emails. Close the tab.
- Already ran it? Disconnect from Wi-Fi or unplug the network cable and call IT straight away. Don’t just restart.
Based on: Microsoft Security — Think before you Click(Fix)
Still stuck after those?
You’ve done the right thing by trying. Send whedo.it a quick note — what you tried, what you saw — and a senior pair of eyes will be on it the same business day.