05/06/2026
If a website ever tells you to press Windows Key + R, close the tab.
That single instruction is the giveaway for a fast-growing scam called ClickFix, which has been behind a wave of infostealer infections all year.
An infostealer is malware that scrapes every saved password, browser cookie, session token, and stored credit card...
You click a Google result that takes you to a hacked website.
A fake CAPTCHA pops up and tells you to press Windows Key + R, then Ctrl + V, then Enter to verify you're human.
The second you hit Enter, you've installed malware on your own machine.
This attack slips past most security tools because you run the command yourself.
No file was downloaded, so antivirus has nothing to scan.
The browser shows no warning.
From the operating system's perspective, you typed a command into a Windows utility, the same as any admin doing real work.
A few things you can do this week:
▶️ Tell your team that if any website prompts the user to press Win+R or paste something into the Run box, they should close the tab and report it.
▶️ Restrict PowerShell for non-IT staff using AppLocker or Windows Defender Application Control. Most office employees have no work reason to run PowerShell scripts.
▶️ Make sure your endpoint protection is doing behavioral monitoring and not just signature scanning. Microsoft Defender for Endpoint and most modern EDR tools have detection rules specifically for this attack chain.
There's no shame in falling for a fake CAPTCHA. They're designed to look real. But once your team knows the keystroke trick, this scam stops working on them.
