A CAPTCHA asked you to press Windows + R. It is not a CAPTCHA.

What you probably saw

A page that looks like a familiar check: “Verify you are human”, a Cloudflare-style box, a reCAPTCHA-style tick, a “browser update”, a document that “failed to load”. You click the box and new instructions appear:

1. Press Windows + R (on a Mac: open Terminal; sometimes: click the address bar of File Explorer).
2. Press Ctrl + V to paste the “verification code”.
3. Press Enter.

The moment you clicked, the page put a command on your clipboard. What you paste is not a code: it is a short PowerShell, mshta or curl command that downloads and starts a program. That program is usually an information stealer, which collects saved passwords, browser cookies, crypto wallets and session tokens, or a remote-access tool.

The technique is called ClickFix (and FileFix when it uses the File Explorer address bar). It works because you run the command yourself: no download warning, no exploit, nothing for e-mail filters to block.

Why the page looked normal

• It is often a real website. Attackers hide the fake check on hacked WordPress sites, booking pages and shops, so the address can be one you trust.
• It copies real designs. The box, the logo and the wording imitate checks you see every day.
• The command is hidden. You only see it if you paste it somewhere visible. In the Run box it is long and starts with words you do not recognise.

What to do now

You did not press Enter

Close the tab. Copy any harmless text (for example a word on this page) so the command is no longer on your clipboard. That is all.

You pressed Enter

1. Disconnect the computer from the internet (unplug the cable, switch Wi-Fi off). It stops the program from sending your data.
2. If it is a work computer, tell your IT team now. Tell them the time and the website; it helps them find the infection.
3. Run a full antivirus scan (Microsoft Defender: Virus & threat protection → Scan options → Full scan).
4. From another device, change the passwords of your e-mail, bank and work accounts, and sign out all other sessions. Stealers take browser cookies, so a password change alone does not always end an active session.
5. Turn on multi-factor authentication where it is off, and watch your bank and e-mail for activity you did not do.

How to never fall for it

One rule covers every version of this attack: no website ever needs you to paste anything into Run, a terminal or the File Explorer address bar. Not to prove you are human, not to fix a page, not to update a browser. If a page asks, it is an attack.

How ByteMantle stops it

• The command never reaches you. When a page writes a harmful command to your clipboard, ByteMantle replaces it with a harmless message. Even if you follow the steps, there is nothing to run.
• The page is recognised. Fake checks, “press Windows + R” instructions and the commands they use (PowerShell, mshta, curl | sh on macOS and Linux) are detected in your browser, before you act.
• You get a plain warning. A clear page tells you what the site tried to do, with one button back to safety.
• Your company sees it too. In the ByteMantle console, IT sees where you came from, the page and the command that was stopped, so they can block the site for everyone.

Detection runs locally in your browser and keeps working offline. Read more about ClickFix protection.

Questions people ask