ClickFix Scams: How Fake "Verify You Are Human" Pages Hack Staff, and Chrome's New Warning
Short answer
ClickFix is a scam where a fake page, often a fake CAPTCHA or error message, tells the visitor to copy a command and paste it into Windows Run or the Mac Terminal to "fix" something. Doing so can install malware that steals passwords. On 21 October 2026, Google announced that Chrome users with Enhanced Protection will see a warning when they copy a suspicious command. The simplest rule for staff: no real website ever asks you to paste commands to prove you are human.
Key takeaways
- ✓ClickFix tricks people into running malware themselves.
- ✓Fake CAPTCHA and error pages are common lures.
- ✓Chrome Enhanced Protection now warns on suspicious copied commands.
- ✓Staff training is the strongest defence.
How a ClickFix attack works
| Step | What happens |
|---|---|
| Lure | Fake CAPTCHA, error or update page |
| Instruction | Press keys and paste a command |
| Execution | User runs the command |
| Payload | Malware or remote access installed |
| Impact | Stolen passwords, accounts, data |
How to protect your team
- Teach the rule: never paste commands from a website.
- Turn on Chrome Enhanced Protection.
- Use two-step verification on key accounts.
- Limit admin rights on work computers.
- Keep devices and browsers updated.
- Create a simple way to report suspicious pages.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth AuditWarning signs of ClickFix
- "Press Windows + R" or "open Terminal" instructions.
- Requests to copy and paste code.
- Urgent "fix this error" messages.
- Fake CAPTCHA with extra steps.
- Unexpected document or meeting links.
- Pages pretending to be Cloudflare or Google.
A worked example
Imagine a Dubai agency where a designer lands on a fake CAPTCHA asking them to paste a command. Because the team learned the "never paste commands" rule in a five-minute briefing, the designer closes the tab and reports it, and the agency blocks the site.
How Husbar helps
Husbar helps businesses secure websites and marketing accounts, and runs simple security briefings for marketing teams. Our funnel and sales page team can take this on end to end, or support your in-house team. book a free Growth Audit.
Questions to ask before you start
- Who has admin rights?
- Is Enhanced Protection on?
- Do we use two-step verification?
- How do staff report scams?
- When was our last briefing?
Key terms
- ClickFix: social engineering that tricks users into running commands.
- Infostealer: malware that steals saved passwords and cookies.
- Enhanced Protection: Chrome's stronger Safe Browsing mode.
Mistakes to avoid
- Assuming antivirus catches everything.
- Giving everyone admin rights.
- No reporting process.
Why a fast, secure website is a sales tool
Your website is often the first serious impression a buyer gets. A slow, broken or hacked site loses trust in seconds, while a fast, clear and secure one quietly turns visitors into enquiries. Security, speed and conversion are not separate projects: they are all part of making the site earn its keep.
Read the website security checklist, AI agents hacking websites and AI vendor risk.
What is a ClickFix attack?+
A scam tricking users into pasting and running malicious commands.
Does Chrome block ClickFix?+
With Enhanced Protection, Chrome warns when you copy suspicious commands.
How do I turn on Enhanced Protection?+
In Chrome settings under Privacy and security, Security.
Are Macs affected?+
Yes, attacks also target the Mac Terminal.
What if someone ran a command?+
Disconnect, change passwords from a clean device and get IT help.
Does Husbar build websites?+
We plan conversion-focused site structures and build landing pages, sales pages and funnels, and we can work alongside your developer on the rest.
How do I get a website review from Husbar?+
Book a free growth audit and we will review your site for clarity, speed, tracking and lead capture.
Sources
- [The Hacker News: Chrome adds ClickFix warnings](https://thehackernews.com/2026/10/google-chrome-adds-clickfix-warnings-to.html)
- [Google: latest defenses against web scams](https://blog.google/security/our-latest-defenses-against-evolving-web-scams/)
Team Husbar
Husbar Editorial
Team Husbar is the strategy, psychology and research team at Husbar, a psychology-led growth agency headquartered in Dubai. Together we have worked with 100+ brands over 10+ years.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth Audit