Prove You're Human... Install This Malware - ClickFix

Wait. The task changed.

You wanted to visit a website. First, apparently, you need to find every motorcycle. Including that tiny corner of a tire, because now that is your job.

A CAPTCHA is a test intended to distinguish a person from an automated visitor. Most of us just want to finish it and get on with the page.

ClickFix takes advantage of that desire to get through a supposed problem. A fake check tells you to open a command tool and paste an instruction. Following it can download and run malware. What looks like one more verification step has turned into permission to run someone else's code.

Ordinary websites, unfamiliar instructions

Netskope's September 3 investigation found the operation across more than 5,400 compromised sites, including ordinary small-business websites and shops. Researchers did not establish how those sites were initially compromised or how many visitors ran the commands.

The report also describes a separate browser-based variant. Not every site or visitor necessarily encountered the same fake CAPTCHA. Nor does the website count tell us how many people were infected.

You do not need the full technical chain to use the lesson: a familiar setting does not make every new instruction part of a normal visit.

When the interruption becomes background noise

Habituation means our response to something gets weaker with repeated exposure. Think of a loud fan that bothers you when it starts, then gradually fades into the background.

An online interruption can become something to get past instead of something to reconsider. The danger is treating a changed request as the same old task. That does not make the person careless. It makes the change worth noticing.

Anderson and colleagues' 2015 study showed 25 participants repeated images of security warnings while measuring brain activity. Visual-processing responses declined with repetition, with a drop apparent by the second viewing. Warnings that changed appearance resisted that decline better.

This was not a study of fake CAPTCHAs or infection rates. It supports the habituation concept, not a claim that it caused every decision in this campaign. We also cannot estimate how many visitors complied from the website total.

One rule you can use without learning code

Never run a computer command to complete a CAPTCHA.

If a page asks you to open a system command tool to prove you are human, close it. You do not need to work out what the command does before declining it.

If you already ran it, closing the browser does not undo a program that started. For a work device, tell your IT or security team what happened. For a personal device, use your operating system's official security guidance or trusted technical help, not a support link supplied by the suspicious page.

You came to use the website. Running a stranger's code was not part of the deal.