ClickFix: The Copy-and-Paste Scam We Found on a Client's Laptop

A real incident at a client of ours. Identifying details have been removed.

ClickFix is a scam that looks like a routine "verify you're human" check on a website. Instead of checking anything, it walks you through pasting a command into your computer, and that command installs malware. The malware can steal the passwords saved in your browser or do whatever else the attacker built it to do.

We found it on a client's laptop in October. A business owner here in the Kansas City area called us because he thought he had a virus. He'd already run a free malware scanner and believed he'd gotten rid of it. The laptop still wasn't right. The Start menu was dead and Microsoft 365 wouldn't let him sign in.

He dropped the laptop off that morning.

What we found

The first clue came from a brand-new test account we set up on the same laptop. It worked normally, which told us Windows itself was fine and the damage was inside his own account.

The cause was sitting in PowerShell's history. PowerShell is a command window built into Windows, and it keeps a running list of the commands entered into it. His list held exactly two lines from before we touched the machine. Each one downloaded a script from a website and ran it on the spot, under his own account.

The laptop had paid antivirus installed and running. It didn't stop either command.

We can't tell you what those two commands installed. They ran in memory and left no copy behind. What we could see was the damage to his account.

How ClickFix works

Those two lines match the ClickFix pattern. The web page shows you something that looks routine, like a CAPTCHA check or a fix for an error. Then it tells you to press a keyboard shortcut that opens a command window and to paste in a line of text it gives you. The text is the command, and you're the one who runs it.

The usual version has people press Windows key + R, which opens the Run box. In March 2026, The Register reported that Microsoft Threat Intelligence had found a campaign that used Windows Terminal instead. It told people to press Windows key + X, which opens a shortcut menu, and then press I, which opens Terminal from that menu. The final payload in that campaign was Lumma Stealer, malware that pulls saved logins out of Chrome and Edge. https://www.theregister.com/2026/03/06/microsoft_spots_clickfix_campaign_abusing/

We don't know which campaign reached our client. The pattern in his history is the same one.

What happened next

We recommended wiping the laptop, because there was no way to know everything those commands had done. He chose to replace it. We set up the new laptop and moved his files over from a backup.

We also told him to change his passwords for Microsoft 365, his bank and his email from a clean device, never from the old laptop, and to sign out of every other session. If what ran was password-stealing malware like Lumma, the logins saved in his browser are exactly what it would have taken.

What to tell your team

• No real website asks you to press keys and paste something to prove you're human or fix an error. If one does, close the tab.
• If someone already did it, they should tell whoever handles your IT the same day, even if nothing seems wrong yet.
• Change passwords from a different device, not the one that ran the command.
• Ask whoever manages your computers what would catch a pasted command. In this case, paid antivirus didn't.

If someone clicked a link in a phishing email instead, our checklist for that is here: https://www.tech360solutions.com/articles/phishing-click-checklist

Tell your team the rule this week, before the pop-up reaches one of them. If you'd like a second set of eyes on how your computers are set up, book a 15-minute review with us: https://www.tech360solutions.com/review

Tech 360 Solutions provides managed IT and cybersecurity for small businesses in the Kansas City metro. Built for HIPAA, FTC Safeguards, and other regulated environments.