A CAPTCHA that tells you to open Windows Run, PowerShell, or Terminal and paste a command is a warning to stop. Real human-verification checks do not require you to run commands on your computer. Close the page and report it through your organization's known support channel.
This scam is commonly called ClickFix. For an IT manager preparing employee guidance, the most useful lesson is the moment the request changes: a website asks the person to move from viewing a page to operating their computer on the website's instructions. The Federal Trade Commission's fake CAPTCHA guidance describes that exact trap.
How a fake CAPTCHA becomes a malware delivery step
A CAPTCHA is a check intended to distinguish a person from automated activity. ClickFix borrows that familiar appearance, or presents a supposed browser error, and offers a short sequence of actions to continue.
In its August 2025 analysis of ClickFix, Microsoft documented lures reached through phishing messages, advertisements, and compromised websites. Some pages copy a malicious command to the clipboard when the person interacts with the fake check. The person is then instructed to paste and execute it in a system tool. The resulting activity can download malware, including information stealers or remote-access tools.
A supplier document that suddenly needs a “repair”
Use this hypothetical example in a team discussion. An accounts-payable employee expects a supplier document. After following a link, the employee sees a verification box and then a message saying the document viewer needs a quick repair.
The plausible part: the employee has a real document to retrieve. A broken viewer sounds like an obstacle to finishing ordinary work. Asking only whether the message looks professional misses the decision.
The stopping point: the page directs the employee to open a system command tool and paste something it supplied. Viewing the supplier document has become a request to execute instructions on the work computer. The employee should stop before following that request, without trying to decode or test the copied text.
The useful alternative: the employee reports the page and reaches the supplier through contact information already held by the business. The document is obtained through the established portal or approved transfer route. In this scenario, the work continues without accepting the site's repair instructions.
That last step belongs in the lesson. Give people a way to finish the legitimate task, including a known help-desk route for genuine software problems. A real support technician may need to perform technical work, but the request should be verified through the organization's established support process.
Give employees a short rule they can use
The following is suggested wording for an internal awareness message:
If a website asks you to open Run, PowerShell, or Terminal to verify yourself or fix a page, stop. Do not paste or run what it provides. Use our established IT support channel. If you already followed any steps, tell us promptly what happened so we can help.
Practice with a written scenario, not a live malicious site or an executable command. Ask the employee to identify the stopping point, find the approved reporting route, and explain how they would obtain the needed document safely. This tests a usable decision without teaching people to rehearse the attack.
Network Box USA's Managed Security Awareness Training combines practical education, phishing simulations, targeted learning, reporting, and managed campaign operations. Those capabilities support teaching recognition and following up on difficult decisions. Agree the actual lesson content and exercise scope with the training team; the scenario here is a proposed teaching example, not a claim that a particular ClickFix simulation is included.
If someone already followed the instructions
Make prompt reporting easy. Ask which device was involved, the approximate time, and whether the person only viewed the page, copied something, or pasted it into a system tool. Microsoft documents that multiline terminal pastes can execute commands automatically. Do not assume that failing to remember an Enter keypress means nothing ran. Do not ask the employee to reproduce the steps.
The FTC recommends disconnecting an affected device from the internet, checking it for malware, and protecting accounts from a different device. For a work computer, activate the organization's incident process so the response team can coordinate containment, evidence preservation, and account actions. Avoid wiping the device or clearing its history before that team gives guidance. Our endpoint isolation and recovery explanation describes why containment and returning a system to service are separate decisions.
For the next awareness session, choose one real business task employees commonly encounter and pair it with a trusted support route. Contact our team to discuss a managed training program that helps employees recognize suspicious instructions and respond usefully.