Fake Captcha Pages: Clipboard Tricks & Info Stealers

Yes, fake captcha pages use clipboard tricks to spread information stealers. These malicious pages instruct you to copy a string of text, which is actually a PowerShell command, and then paste it into a Run dialog or terminal, executing malware that can steal passwords, cookies, and cryptocurrency wallets.

Background: How Real Captchas Work vs. Fake Ones

Legitimate captchas (like reCAPTCHA or hCaptcha) are designed to prove you are human. They ask you to click a checkbox, identify objects in images, or type distorted text. They never ask you to copy text and paste it into a terminal, command prompt, or the Windows Run dialog.

Fake captcha pages mimic the look of these verification systems but add an extra step. The page might display a message like “Press Win+R, then Ctrl+V, then Enter to verify you are human.” This sequence is not a captcha—it is a social engineering trick to get you to run a command. The command is often obfuscated (shortened, encoded, or split into pieces) to hide its true purpose from casual inspection.

How the Clipboard Trick Works

The attack relies on the user unknowingly copying and running a malicious command. Here is the step-by-step mechanism:

• Step 1: You land on a page that shows a fake captcha, often after clicking a link from a torrent site, a free movie streaming site, or a suspicious ad.
• Step 2: The page displays a checkbox or a puzzle. When you click it, a message appears: “Press Win+R to open Run, press Ctrl+V to paste, and press Enter.”
• Step 3: The page has already placed a malicious command in your clipboard (using JavaScript’s navigator.clipboard.writeText()). You don’t see it because the page hides it or shows a fake string.
• Step 4: When you paste (Ctrl+V) into the Run dialog, you are actually pasting a PowerShell command, not a captcha code.
• Step 5: Pressing Enter executes the command. The command downloads and runs an information stealer (like RedLine, Vidar, or Lumma) from a remote server.

This technique is sometimes called “ClickFix” or “ClearFake” by security researchers, because it tricks users into “fixing” a fake issue (like a captcha or a browser error) by running a command.

What Information Stealers Target

Information stealers are malware designed to harvest data from your device. They typically focus on:

• Saved passwords and login credentials from browsers (Chrome, Edge, Firefox).
• Cookies and session tokens – allowing attackers to hijack your logged-in sessions on websites like email, social media, and banking.
• Cryptocurrency wallets – including browser extensions and wallet files.
• Credit card details saved in browsers or auto-fill forms.
• System information – like OS version, installed software, and IP address, which can be sold or used for further attacks.

The stolen data is typically sent to a command-and-control server and then sold on dark web marketplaces or used directly for fraud.

How to Spot a Fake Captcha Page

There are several red flags that can help you identify a fake captcha before you fall for it:

• It asks you to copy and paste code. Legitimate captchas never ask you to use the Run dialog or terminal.
• The page uses unusual phrasing. Messages like “Press Win+R to verify” or “Run this command to continue” are not standard.
• The URL is suspicious. Often the page is on a domain that doesn’t match the site you intended to visit, or it has a random string of characters.
• The page appears after clicking a link from a questionable source. Torrent sites, free streaming sites, and pop-up ads are common entry points.
• The captcha looks slightly off. It might have blurry text, odd layout, or be missing the logo of the captcha provider.

If you see any of these signs, close the tab immediately. Do not follow the instructions.

What to Do If You Already Ran the Command

If you suspect you have already executed a command from a fake captcha, act quickly:

1. Disconnect from the internet – this can prevent the malware from sending your data.
2. Run a full antivirus scan – use a reputable security suite and follow its recommendations.
3. Change your passwords – from a different, known-clean device. Prioritize email, banking, and other sensitive accounts.
4. Enable two-factor authentication (2FA) on all important accounts.
5. Check for new browser extensions – remove any you don’t recognize.
6. Monitor your accounts for suspicious activity, such as unauthorized transactions or password reset emails.

If the malware is sophisticated, you may need to back up important files and reinstall the operating system to be fully safe.

Common Misconceptions About Clipboard Attacks

Many people think that a clipboard attack is a new, exotic hack. In reality, it is a simple social engineering technique that has been around for years. It doesn’t exploit a system vulnerability; it exploits human trust. The command you paste is not a captcha, but it looks like one because the page tells you it is. Also, some people believe that having an antivirus is enough. While good antivirus can block known malware, this attack is designed to trick you into bypassing security warnings by running the command yourself. The malware is often new or obfuscated, so it may not be detected immediately.

How to Protect Yourself

Prevention is the best defense. Here are practical steps to avoid falling victim:

• Never copy-paste commands from websites into your terminal or Run dialog unless you are absolutely sure what they do and you trust the source.
• Use a browser extension that blocks known malicious domains (like uBlock Origin, but be aware it is not a silver bullet).
• Keep your operating system and software updated – this patches known vulnerabilities.
• Be cautious with links from untrusted sources, especially those that promise free content.
• Use a standard (non-admin) user account for daily activities – this limits the damage malware can do.
• Consider using a password manager – it can help avoid reusing passwords and makes it easier to change them after an incident.

Frequently Asked Questions

Can a fake captcha infect my phone?

Yes, but the clipboard trick is less common on mobile because the Run dialog is a Windows feature. However, fake captcha pages can still try to trick you into installing malicious apps or granting permissions. On Android, they might ask you to enable “Install unknown apps” or paste a command into a terminal emulator. On iOS, the risk is lower due to sandboxing, but be cautious of any page that asks you to install a profile or certificate.

What is the “ClickFix” attack?

ClickFix is a social engineering technique where a website displays a fake error or captcha and instructs the user to copy a command and paste it into the Windows Run dialog (Win+R) or PowerShell. The command downloads and executes malware. It’s a form of the clipboard trick, named because the user is “fixing” a fake issue.

How do I check what’s in my clipboard?

On Windows, you can press Win+V to open the clipboard history (if enabled). On macOS, you can use the Finder menu “Edit” > “Show Clipboard” (or use the shortcut Cmd+Shift+V in some apps). On Linux, it depends on the desktop environment. If you see a long string of text that looks like a command, do not paste it anywhere.

Can antivirus software detect this attack?

Antivirus can detect the malware if it has been seen before, but the attack itself is a social engineering trick that doesn’t rely on a vulnerability. The command is often obfuscated, and the malware is frequently updated to avoid detection. However, a good antivirus may block the download or execution of the payload. Still, the best defense is to not follow the instructions.

Is it safe to copy text from any website?

Copying text itself is generally safe, but be aware that a website can write to your clipboard without you explicitly copying (using JavaScript). This is why it’s dangerous to paste into a terminal or Run dialog without checking what is actually in your clipboard. Always paste into a plain text editor (like Notepad) first to see the content.

What should I do if I already copied but didn’t run the command?

If you copied the text but did not paste it into a terminal or Run dialog, you are likely safe. Just clear your clipboard (copy something else) and close the page. However, if you pasted it into a terminal and pressed Enter, follow the steps in the “What to Do” section above.

Related

• Google Wallet Features I Wish I Knew Sooner
• Patreon vs Ko-fi: Which Is Better for Creators?
• Reasons Need Firewall Boost Security?