--- title: Fake human verification: how to spot a ClickFix attack description: A human check should never ask you to run commands. See real ClickFix fake verification screens, learn the warning sign, and know when to contact IT. url: https://www.gammatechservices.com/blog/clickfix-fake-captcha-attacks/ --- # Fake human verification: how to spot a ClickFix attack You should never have to run a command on your computer to prove you’re human. ![Laptop displaying a verification prompt beside a command window.](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-hero-concept.webp) You’ve probably checked a box or selected pictures to prove you’re human. These checks can look different across websites, which makes a convincing fake easy to miss. **A human-verification page that tells you to open a command window, paste something, and run it is an attack. Stop and contact IT.** The instructions may say to press the Windows key and R, paste with Ctrl+V, and press Enter. ## What a normal human check looks like A normal check happens in your browser. It might ask you to select pictures, check a box, or wait briefly. [Cloudflare’s challenge documentation](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/) describes automatic checks and interactions that stay on the web page. Running a computer command is never part of proving you’re human. Treat any request to open Run, PowerShell, or Terminal for verification as a reason to stop. ## Real examples of fake verification screens These screenshots show actual attack pages documented in [Microsoft’s ClickFix research](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) . Both use familiar verification language to lead someone into running a command. Do not follow the steps shown in these attack examples. ### A familiar-looking human check ![Fake Cloudflare human-verification screen with instructions to open Windows Run, paste clipboard contents, and press Enter.](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-fake-cloudflare-screen.webp) Attack example: a fake Cloudflare check. The request to run a command reveals the danger. Source: [Microsoft, Figure 13](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) . [View the screenshot](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-fake-cloudflare-screen.webp) . The copied branding can make the page feel routine. The request to open a computer tool and run something is your signal to stop. ### A request to prove you’re human by pasting ![Fake verification pop-up directing a person to press Windows and R, paste with Ctrl+V, and press Enter.](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-fake-human-check-screen.webp) Attack example: a fake check on a site impersonating the Social Security Administration. Source: [Microsoft, Figure 10](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) . [View the screenshot](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-fake-human-check-screen.webp) . The paste step matters. A button on the fake page can quietly copy a malicious command to your clipboard. Following its next instructions can run that command and install malware. ## How people encounter this attack ClickFix is the name for this trick: a page persuades you to run a harmful command yourself. Fake human verification is one common lure. Other versions claim your browser needs an update or a download needs fixing. These prompts can arrive through email links, ads, or compromised websites. A familiar website can also be affected. A [September 2026 government security alert](https://www.ncsc.govt.nz/alerts/compromised-websites-serving-clickfix-pages/) describes fake CAPTCHA and Cloudflare pages appearing on compromised sites. Windows and Mac users both need to watch for command requests. ## What to do at a suspicious prompt - Stop following the instructions. Leave copied text unused. - Contact IT using your established support number or portal. - Tell IT what you were doing and whether you clicked, pasted, pressed Enter, or entered a password. - Take a screenshot only when you can do so safely without interacting further or exposing private information. You can report uncertainty, too. A quick description of what happened helps IT decide what to check. ![An employee pauses a copied command from a fake verification prompt and sends it for IT review.](https://www.gammatechservices.com/wp-content/uploads/gamma-blog-review/gamma-2026-10-08-it-clickfix-r4/media/clickfix-fake-verification-fig-01.webp) ## Contact IT immediately after running a suspicious command A computer can appear normal after a harmful command runs. Use a separate phone or trusted device to get help, and follow your company’s incident procedure. - Disconnect the affected computer from Wi-Fi and unplug its network cable. - Leave it powered on after disconnecting unless IT directs otherwise. Avoid restarting it or attempting a cleanup. - Stop using it for email, banking, or password changes until IT clears it. These first steps adapt [CISA’s malware-containment advice in its ransomware guide](https://www.cisa.gov/stopransomware/ransomware-guide) . IT should direct recovery and any account-protection steps. Network disconnection helps contain the incident while preserving evidence for investigation. Gamma Tech helps Naples and Southwest Florida businesses with [cybersecurity](https://www.gammatechservices.com/it-cybersecurity/) and [managed IT](https://www.gammatechservices.com/managed-it/) . Existing clients should use their established support route. Businesses needing help can [contact Gamma Tech](https://www.gammatechservices.com/contact/) at (239) 330-4939. --- Gamma Tech Services · (239) 330-4939 · 3106 Horseshoe Dr S, Naples, FL 34116 · https://www.gammatechservices.com/contact/