Highlighted wordsare glossary terms — tap one for a plain-language definition.
You search for a new AI tool, click a polished result, and a message appears: “VerificationWhat it means: Confirming a request through a separate, trusted method.Example: Calling the number on the back of your card instead of the one in the message.What to do: Save official phone numbers and app logins now, before you need them.Important: Never verify using contact details supplied in the suspicious message itself.What does this mean? failed” or “Complete these steps to install.” It tells you to open Windows Run, PowerShell, Command Prompt, or Terminal and paste something in — maybe even to prove you're human. Stop. This is a social-engineering technique called ClickFix, and it works by persuading you to run the attack yourself. [1, 2]
What ClickFix is
Instead of breaking into your computer automatically, a ClickFix page gives you instructions that persuade you to copy, paste, or run something on your own device. The instructions pretend to fix a browser problem, complete a CAPTCHA, verify you're human, install or update software, open a document, or unlock a video. The command then downloads MalwareWhat it means: Software designed to damage, spy on, disrupt, or gain unauthorized access to a device.Example: A “free video player” download that quietly installs something else.What to do: Install apps only from official stores and keep automatic updates switched on.Important: Pop-ups warning that your device is infected are usually the scam itself.What does this mean? or does something you never intended. Microsoft has observed ClickFix campaigns reaching people through PhishingWhat it means: A deceptive email or message designed to make you click, share information, send money, or give account access.Example: An “unpaid delivery fee” text with a link to a page that looks like the post office.What to do: Don't tap links in unexpected messages — open the company's app or type its address yourself.Important: Real companies never ask for your password or a login code by message.What does this mean?, malicious ads, and compromised websites, targeting both Windows and macOS users — and one variant even crashed people's browsers on purpose, then offered a fake 'fix.' [2, 3, 4]
- Fake CAPTCHAs, browser-error pop-ups, and 'installation errors' are common ClickFix disguises.
- A page that copies a command for you automatically is a warning sign, not a convenience.
- It affects Windows and Mac users alike.
Why it works — they borrow your hands
ClickFix leans on a normal instinct: 'Something isn't working, I should fix it.' Confusion, impatience, curiosity, and worry make technical instructions feel more reasonable than they are. Because you perform the dangerous step yourself, using legitimate tools built into your computer, the activity can look like ordinary use — which is why it can slip past some traditional protections. [1, 2]
- Feeling rushed or confused by a 'broken' page is the moment to pause.
- Legitimate system tools can be misused when a stranger chooses the command.
🚩 The Hygi red flag
A webpage should not need you to paste an unexpected command into your computer to prove you're human, fix your browser, or finish an ordinary download. Be especially cautious if a site unexpectedly tells you to open PowerShell, Windows Run, Command Prompt, Terminal, or another system tool. Those tools aren't dangerous on their own — the danger is letting an unfamiliar website decide what you run. [1, 2]
- Real CAPTCHAs never ask you to leave the browser.
- Never paste a command from a website into Run, PowerShell, or Terminal unless you fully understand and expected it.
Why AI tools are the bait
Criminals borrow trusted brands and hot topics, and AI is both. Microsoft has documented campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek through phishing, malicious ads, fake installers, and credential-stealing malware. That doesn't mean those AI services were hacked — the attacker is wearing a fake employee badge, borrowing the company's name to look believable. Top search results and sponsored ads aren't proof of legitimacy either. [5]
- Find the company that actually makes the software, then go to its known official site or a trusted app store.
- Check the web address before downloading.
- Be suspicious if an install suddenly needs unusual technical steps.
The 10-second habit: Stop — Check — Go
STOP: don't copy, paste, download, or run anything yet. CHECK: Why does this site need me to do this? Did I expect it? Am I really on the company's official website? Is it asking me to leave the browser for a system tool? Could I do this through the official app instead? GO: continue only after you've verified the instructions independently. If anything still feels strange, close the page and start again from the official website. Browsers are adding help too — Google says Chrome's Enhanced Protection now warns about suspicious sites and scam tactics. [1]
- Give yourself ten seconds before acting on any unexpected technical instruction.
- When in doubt, close the tab and navigate to the official site yourself.
- Turn on your browser's strongest scam protection setting.
If you already ran the command
Don't panic, but don't ignore it. Stop entering Sensitive informationWhat it means: Information that could cause greater harm if exposed, such as financial, health, identity, or login information.Example: Your national ID number, medical records, or banking logins.What to do: Keep it in an encrypted place and never send it by plain email or text.Important: Legitimate organizations don't ask for full ID numbers or passwords by message.What does this mean? on that device and close the suspicious page — don't go back to 'undo' anything. Run the security tools built into your operating system or another product you trust, and consider disconnecting the computer from the internet while you check. From a separate, trusted device, secure your most important accounts first: primary email, financial accounts, Password managerWhat it means: Software that generates, stores, and fills unique account passwords, and may also manage passkeys or other credentials.Example: The manager generating and filling a 20-character password you never have to recall.What to do: Set one up and move your email, banking, and cloud passwords into it first.Important: Protect it with one strong passphrase plus MFA, and never share that passphrase.What does this mean?, your Apple, Google, or Microsoft account, and work accounts. Turn on Multifactor authenticationWhat it means: Using more than one type of authentication evidence before an account grants access.Example: Entering your password and then approving the login through an authenticator app.What to do: Turn it on first for your email, financial, social-media, and cloud accounts.Important: Never give an unexpected login code to someone who contacts you.What does this mean? — passkeys or security keys where supported — and get qualified technical help if you're unsure, because an unknown command can make changes that are hard to see. At work, tell your IT team right away. [2, 4]
- Use a known-clean device to change passwords if you think information was stolen.
- Start with email — it can reset everything else.
- Ask for qualified help rather than guessing.
Your Hygi challenge
Over the next week, notice every time a website asks you to download, install, grant permission, copy something, change a setting, or enter a command. Before acting, ask: “Did I expect this — and can I verify it another way?” Practicing the pause when nothing is wrong makes it easier when something really is. Your promise: I will not paste an unexpected command from a webpage into my computer just because the website tells me to.
- Unexpected technical instructions deserve verification before action.
- Next up: the Social engineeringWhat it means: Manipulating a person into revealing information or taking an unsafe action.Example: Someone posing as a new coworker who needs a shared password “quickly”.What to do: Verify who you are talking to through a channel you already trust before acting.Important: Pressure plus secrecy is the pattern to watch for, whatever the story.What does this mean? Defense pathway, where trust itself is the attack surface.
Why Hygi. recommends this — the guidance above follows these published sources:
Google Chrome Security
Our latest defenses against evolving web scams (Oct 20, 2026)(opens in a new tab)Chrome's new suspicious-site warnings and Enhanced Protection defenses against social engineering and scams.
Microsoft Threat Intelligence
Think before you Click(Fix): Analyzing the ClickFix social engineering technique (Aug 21, 2025)(opens in a new tab)ClickFix campaigns via phishing, malvertising, compromised sites, fake CAPTCHAs, Windows Run, Terminal, and PowerShell.
Microsoft Defender Security Research
New ClickFix variant ‘CrashFix’ deploying Python Remote Access Trojan (Feb 5, 2026)(opens in a new tab)A variant that deliberately breaks the browser, then presents fake instructions to 'fix' it.
Microsoft Security Research
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide (Aug 5, 2026)(opens in a new tab)ClickFix targeting macOS users to distribute information-stealing malware.
Microsoft Security
Detect and disrupt AI-themed attacks with Microsoft Defender (Sep 10, 2026)(opens in a new tab)Attackers impersonate ChatGPT, Copilot, Claude, and DeepSeek; the AI services themselves were not compromised.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary