A site asks you to confirm that you are not a robot. The screen looks like that of a normal CAPTCHA, but after clicking on the verification box an unusual request appears: press some key combinations to complete a supposed security check. By following these instructions, however, you could end up installing malware on your computer without even realizing it.
The Federal Trade Commission (FTC), the US agency that deals with consumer protection, also warned against this social engineering scam, with a warning published in June 2026. The deception is part of the technique known as ClickFixalready identified in Italy as well. The danger comes not from the verification itself, but from the additional instructions with which cybercriminals try to convince users to execute malicious commands on their devices.
How the CAPTCHA scam works
CAPTCHAs are systems used by websites to distinguish people from automated programs. They can ask you to check a box, recognize certain elements in a series of images or, in newer systems, perform almost invisible checks while browsing. It is precisely the familiarity with these controls that makes the deception credible.
The fake CAPTCHA can appear on a page created by scammers, reached for example through a link received via email, or on a legitimate site that has been compromised. The screen can mimic the look of popular services, such as Google reCAPTCHA or Cloudflare Turnstile, and present the operation as an essential step to access content.
In one of the variations described by the FTC, the user is asked to press the Windows + R key combination to open the Windows Run window, then Ctrl + V to paste the contents of the clipboard, and finally the Enter key to launch the entered command. The crucial detail is that, in some campaigns, the site has already copied a malicious instruction into the clipboard, often without the person realizing it. The user thus believes they are completing a security check, while making the system execute a command prepared by the scammers.
The latter can take advantage of tools already present in Windows, such as PowerShell, which allows you to execute commands on the system, download and launch programs. Depending on the campaign, the result may be the installation of software capable of stealing passwords and other sensitive information, or allowing unauthorized access to your computer. This is not necessarily a file that the user sees the browser downloading. Some operations may take place without immediately recognizable signals.
This mechanism is based on social engineering. Rather than necessarily exploiting a software vulnerability, cybercriminals convince the victim to perform the dangerous action themselves. The technique is not limited to Windows, but has also been observed on Macs, where the instructions may invite you to open the macOS Terminal and paste a command.
An indication of the diffusion of ClickFix it also comes from CERT-AGID data: in 2025, the body recorded around 70 campaigns attributable to this technique as part of its monitoring of cyber threats in the “Bel Paese”.
How to defend yourself and recognize a real verification from a false one
The most important signal is not the box graphics, which can be easily reproduced, but what you are being asked to do. Genuine checks take place within the site or browser and do not require you to open operating system tools, such as the Run window or PowerShell on Windows, or the Terminal on macOS, to paste and execute instructions.
Another alarm bell is the presence of difficult to understand text strings to copy or alleged repair procedures to follow to unblock navigation. Expressions like “security check” or “confirm that you are a person” do not make such a request reliable.
Context can offer other clues. A control that suddenly appeared, especially after an unexpected redirect, deserves attention. However, the address of an apparently legitimate site is not enough to exclude the risk, because some attacks have been distributed via compromised pages. Likewise, the presence of logos or colors associated with known services does not guarantee that the verification is authentic.
When faced with suspicious instructions, it is advisable to interrupt the procedure and close the page, without copying or carrying out what is requested.
What to do if you clicked on the fake “I am not a robot”
Having viewed the screen or clicked on the box does not in itself mean that you have installed malware. In the variant of ClickFix described, the decisive step is the execution of the malicious command.
If the command has been initiated, it is prudent to consider the device potentially compromised even in the absence of obvious symptoms. The FTC recommends first disconnecting it from the Internet, to stop any communication of the malicious program with the outside world, and running a scan with reliable security software, preferably already installed and updated. If you cannot verify that the malware has been eliminated, you should contact a qualified technician.
Since some programs spread through ClickFix are designed to steal credentials, it is also important to change the passwords of the most important accounts, as well as activate two-factor authentication, carrying out these operations from another device considered safe. It is preferable to start from the main email inbox, which often allows you to regain access to other services. If you suspect that bank data has been stolen or you notice unauthorized movements, you should promptly contact the bank through its official channels.
