North Bay Computer

If a website ever tells you to press Windows + R, congratulations: you have found a scam.

That little keystroke trick is the calling card of ClickFix, a fast-growing malware scheme that basically says, “Why hack around security tools when we can just get the user to install the problem for us?”

Here is how it works:
You land on a hacked site, a fake CAPTCHA pops up, and it asks you to press Windows + R, then paste and run a command to “prove you’re human.”

You do it.
The malware says thank you.
Your passwords, cookies, session tokens, and maybe even stored credit cards start packing their bags.

The sneaky part?
Most security tools do not see a download, because you ran the command yourself. To Windows, it looks less like an attack and more like someone having a very suspiciously bad idea.

A few smart moves:
▶️ Teach your team: if any website asks them to use Windows + R, close the tab immediately.
▶️ Restrict PowerShell for non-IT staff. Most employees do not need it, and malware knows that.
▶️ Use endpoint protection with behavioral monitoring, not just signature scanning.

Fake CAPTCHAs are designed to look convincing. No shame there. But once your team knows the Windows + R = nope rule, this scam loses a lot of its magic.

A new phishing campaign is mimicking Google Workspace pages to steal login codes and certificates. Even tech-savvy users can be fooled by these perfect clones. Have you trained your team on how to spot the latest fake login pages?



https://www.helpnetsecurity.com/2026/04/08/social-engineering-open-source-developers