Curiosity Killed the Time

The malware of the season is not a virus you passively catch by visiting a bad site. It’s a trick that convinces you to run the malware yourself, which is exactly why it works.

What the fake page looks like

You are browsing a website, often a legitimate small-business site you have used before, such as a local shop. The site itself was hacked by criminals, but nothing about it looks broken. Maybe a box appears that interrupts whatever you were doing. In any case, the page shows a fake “prove you are human” check, dressed up to look like one of these:

• A CAPTCHA, the “click the checkbox” or “solve the puzzle” screens you are used to
• A Cloudflare-style “Verifying you are human” or “Checking your browser” screen
• A fake error message claiming something is broken and can be “fixed in one click”

This is the heart of the scam. Those reassuring-looking prompts are not prompts at all. There is nothing to click. Instead, the page gives you instructions and tells you to do something technical yourself.

On Windows

The fake prompt tells you to press the Windows key plus R to open the Run box, or to open PowerShell or Command Prompt, and then to paste a command it has conveniently copied for you. The command is supposedly there to verify you or fix the site (Malwarebytes).

On a Mac

The same trick now appears on Macs.

One variant uses an applescript:// link. Clicking the page's button opens Script Editor, a scripting app built into macOS, with the attacker's script already filled in for you to run. Researchers at Jamf Threat Labs say the change was likely intended to bypass a warning Apple added in macOS 26.4 that appears when you paste commands into Terminal, a warning that Script Editor does not trigger (Jamf Threat Labs). Other Mac versions simply tell you to open Terminal and paste a command (Bitdefender).

The one sentence to remember: No legitimate CAPTCHA, browser check, or website ever asks you to open Run, Terminal, or Script Editor and paste a command. If a page asks you to do that, it is a scam every single time.

What happens if you fall for it

The moment you paste that command and press Enter, it downloads real malware and runs it. This is called ClickFix, and it has become the dominant way criminals deliver malware. Researchers at ReliaQuest, analyzing attacks from March 1 to May 31, 2026, found that ClickFix led initial access in 14.9 percent of incidents, driving nearly 28 percent of defense-evasion activity, and that it reached macOS for the first time (ReliaQuest). ClickFix is a social-engineering technique, not a malware family, which is why the payloads it delivers keep changing (Dark Reading).

What the malware does depends on the campaign, but the most common payoff is an infostealer, software built to silently collect whatever valuable data is on your device:

• Saved passwords stored in your browser
• Session cookies, which in some cases let criminals into your accounts even if you have two-factor authentication turned on (Malwarebytes)
• Saved payment and autofill details
• Cryptocurrency wallets
• Files that look sensitive

Two things make this especially damaging. First, there is often no obvious sign you are infected. The malware loads in memory and sends your data out quietly (Malwarebytes). Second, because the command arrives through tools already built into your system, and its payload is deliberately obfuscated, it can slip past defenses that watch for suspicious downloads. That evasion is the entire point of the trick (ReliaQuest).

If you think you already did it

Act now, in this order.

1. Disconnect from the internet, by turning off Wi-Fi or unplugging the cable, to cut off the malware's connection while you clean up.
2. Change your most important passwords from a different device, such as your phone or another computer that was not affected. Start with email, banking, and anything financial. Assume anything saved on the affected device is compromised.
3. Keep to the different-device rule. Do not type new passwords on the infected machine until it has been cleaned, or you may hand them straight to the attacker.
4. Run a full scan with up-to-date security software, and follow its removal steps. Stealers are built to hide, so a full scan matters more than simply deleting the pasted command (Malwarebytes).
5. If money, work logins, or an employer device are involved, assume those may be compromised too. Report it to your workplace IT department or your bank as appropriate. Stolen data is often resold and reused days or months later.

How to keep this from happening to you

• The one rule that beats the whole con: never paste a command into Run, Terminal, or Script Editor because a webpage told you to. No legitimate site will ever ask.
• Slow down. These scams manufacture urgency, with countdown timers and “your computer is infected” warnings, to make you act before you think (Malwarebytes).
• Keep your operating system and browser updated.
• Use multi-factor authentication. It is not a perfect shield against this attack, because a stolen session cookie can bypass it, but it remains the single most valuable protection to turn on everywhere.
• If you run a website, or know someone who does, keep WordPress and all its plugins updated, and use strong unique admin passwords plus two-factor authentication. Compromised small-business sites are exactly where these fake prompts are hosted, and Australia's cyber security agency has issued an advisory about the technique (Australian Cyber Security Centre).

Why it feels like it is everywhere

Two things changed in the last two years.

The hackers industrialized it. In the span of about two years, ClickFix went from an odd novelty to the leading delivery technique, and in this period it began shifting from compromised websites to emailed links (ReliaQuest). Because it relies on you doing the pasting rather than on a software bug, it slips past most automated defenses.

Their infrastructure is hard to kill. In one operation documented in September 2026, researchers at Netskope found more than 5,400 compromised websites, most of them running WordPress or PrestaShop, serving ClickFix lures, with the payload stored in a smart contract on the BNB Smart Chain Testnet. The technique, known as EtherHiding, leaves no single server to take down (BleepingComputer, Netskope).

That is a scalable, and currently “winning” form of cybercrime. The good news is that its whole mechanism depends on one decision you make: pasting a command. Do not make it, and the trick fails against you every time.