Before You Click “I’m Not a Robot”: How to Spot the ClickFix Scam

You’re browsing the internet when a familiar message appears: “Verify you are human.” It might look like a normal CAPTCHA check, a Cloudflare security screen or a prompt asking you to fix a browser problem.

But if the instructions ask you to open a computer tool, press keyboard shortcuts, or copy and paste something into your device, stop. You could be looking at a ClickFix scam designed to trick you into running malicious commands.

New Zealand’s National Cyber Security Centre issued an alert on 2 September 2026 about compromised websites serving fake verification pages. The alert explains that these prompts can lead to information-stealing software or other malware being installed on a visitor’s device. Read the official NCSC alert.

What is the ClickFix scam?

ClickFix is a form of social engineering. Rather than relying only on a technical vulnerability, attackers manipulate people into taking actions that can compromise their devices.

The scam may begin when you visit a compromised website. A fraudulent verification screen appears, often imitating a CAPTCHA or Cloudflare check. Instead of asking you to complete a normal image puzzle or tick a checkbox, the page may tell you to follow instructions involving keyboard commands or copied text. Following those instructions can execute malicious commands and install malware.

The New Zealand government’s Own Your Online alert also warns about fake verification pages. Familiar logos and convincing designs are not proof that a prompt is safe.

Five warning signs to watch for

1. The CAPTCHA asks you to copy and paste commands

A normal human-verification challenge should not require you to copy a command and execute it using a computer tool such as Windows Terminal, PowerShell or macOS Terminal. If a page instructs you to do this, do not continue.

2. A pop-up claims your browser needs fixing

Be cautious if a page suddenly claims your browser is broken, your device needs an urgent update, or you must complete an unusual step to continue. Avoid downloading software or running commands offered by unexpected pop-ups. If you genuinely need a browser update, use the browser’s own settings or its official website.

3. The page asks for your password or personal information

A CAPTCHA is intended to verify that you are human. It should not require your banking password, email password or other sensitive account credentials. If you need to check an account, navigate to the organisation’s official website yourself rather than using a link supplied by a suspicious prompt.

4. You are pressured to act immediately

Scammers create urgency to discourage careful thinking. Messages such as “Complete this step now” or “Your device will be blocked” should make you pause when combined with unusual technical instructions.

5. The instructions are unusual for a simple task

Ask yourself why a website would need you to run a command on your computer just to view a page. If the answer is unclear, do not proceed.

Practical rule: if a website asks you to run a command, disable a security feature, or install an unexpected application to prove you are human, leave the page instead.

What should you do if you see a suspicious CAPTCHA?

  1. Stop interacting with the page. Do not copy, paste or run any commands.
  2. Close the suspicious tab or browser. Do not follow instructions displayed by the page.
  3. Avoid downloading anything offered by the prompt.
  4. Keep your device and browser updated through their normal settings and trusted update channels.
  5. If you remain concerned, run a security scan using reputable security software.

Simply encountering a suspicious page does not prove your device has been infected. The important thing is to avoid following fraudulent instructions.

What if you already copied and ran the command?

If you followed the instructions and executed a command, treat the situation more seriously. Malware may be able to access information on your device, depending on what was installed and which permissions it obtained.

Step 1: Disconnect the affected device from the internet

Turn off Wi-Fi or disconnect the network connection to help limit further communication with a potential attacker. If this is a work computer, contact your organisation’s IT or security team promptly and follow its incident-response procedures.

Step 2: Do not enter more passwords on the affected device

Use a separate, trusted device to access important accounts while you arrange help. Start with your primary email account and online banking, because access to these accounts can create further risks.

Step 3: Secure your accounts

  • Change passwords for accounts that may be affected, using a trusted device.
  • Prioritise email, banking and other important accounts.
  • Use unique passwords rather than reusing the same password.
  • Enable two-factor authentication wherever available.
  • Review account activity and sign out unfamiliar sessions where possible.

If you suspect banking information has been exposed, contact your bank immediately using its official contact details.

Step 4: Get trusted technical assistance

Run an appropriate security scan and seek help from a reputable IT professional if you are unsure how to assess or clean the device. Do not trust another pop-up that promises to remove the problem, and do not install an unfamiliar “cleaner” application suggested by a stranger.

Step 5: Report the incident

New Zealand’s NCSC provides an official route for reporting cybersecurity incidents. Start with the NCSC ClickFix alert or consult Own Your Online’s help and recovery guidance.

Six habits that help protect your devices

  • Keep your operating system updated. Install security updates through your device’s normal update settings.
  • Update your browser. Use its built-in update mechanism or the developer’s official website.
  • Download software from trusted sources. Be cautious about applications supplied through unexpected messages, pop-ups or unfamiliar websites.
  • Do not run commands you do not understand. A website should not need you to execute an unfamiliar command just to complete a routine verification step.
  • Back up important files. Maintain backups of important documents and photos. Where possible, keep a backup separate from your everyday device.
  • Use strong, unique passwords and two-factor authentication. These measures can help reduce the damage caused by stolen login details.

These are practical protective measures, not a guarantee against every threat. If a device may already be compromised, take steps to assess and resolve the incident rather than relying on good habits alone.

Does a genuine CAPTCHA ever ask you to open Terminal?

You should not need to run a computer command to complete an ordinary human-verification challenge. Legitimate CAPTCHA systems typically ask you to complete a visual puzzle, select images or use a checkbox. New Zealand’s Own Your Online guidance warns that genuine verification systems do not ask users to execute keyboard commands, copy and paste commands, or provide passwords.

If a prompt asks you to open Terminal, PowerShell or another system utility, stop and verify the website through a trusted route.

Is every CAPTCHA or Cloudflare page dangerous?

No. CAPTCHA and Cloudflare verification systems are legitimate technologies used by websites. The concern is that criminals can imitate these systems or place fraudulent prompts on compromised websites. The NCSC alert confirms that ClickFix-style activity has been reported; it does not mean every verification page is malicious or every visitor has been affected.

The safest approach is to judge the instructions, not just the appearance of the page.

Final thoughts: pause before you click

Online scams often work because they make an unusual action feel like a normal part of browsing. ClickFix turns a familiar task—proving you are human—into a potential security risk by persuading visitors to run commands themselves.

  • Never run a command just because a website tells you to.
  • Never enter sensitive information into an unexpected verification prompt.
  • If you have already run a suspicious command, disconnect the device, secure your accounts from a trusted device and seek help.

A few seconds of caution can help protect your photos, files, passwords and personal information.

This article provides general technology and cybersecurity information, not a diagnosis of an individual device or incident. If you believe your device has been compromised, seek appropriate technical assistance.

Explore IT FOX SOLUTIONS

Looking for technology accessories? Browse our Phones & Smartphones and Computer & Gaming Accessories collections.

Back to blog