Photo: Cybercriminals are creating convincing copies of familiar “I’m not a robot” verification screens that instruct users to run computer commands. The ClickFix technique can install information-stealing malware and is continuing to evolve on both Windows and Mac computers.

Canadians are being warned to take a closer look at familiar “I’m not a robot” verification screens as cybercriminals increasingly use convincing copies to trick people into installing malicious software on their own computers.

The technique, commonly known as ClickFix, disguises malicious instructions as routine CAPTCHA verification, software updates or technical fixes.

Instead of simply asking a user to check a box or identify pictures, a fraudulent page may instruct the person to press a combination of keyboard keys, open the Windows Run command or a computer terminal and paste information that has been copied to the clipboard.

Following those instructions can cause the computer to execute malicious code and download malware. Microsoft says the technique has been used to distribute information-stealing programs capable of stealing passwords and other sensitive information.

A June report aimed at Canadian consumers warned that the attacks could expose passwords, banking credentials and access to cryptocurrency wallets.

The danger comes partly from the familiarity of CAPTCHA tests. Internet users have become accustomed to clicking an “I’m not a robot” box before entering websites or completing online transactions, making a realistic-looking copy less likely to immediately raise suspicion.

A legitimate CAPTCHA should not require someone to open Windows Run, PowerShell or Terminal and paste or execute a computer command.

Microsoft Threat Intelligence reported Aug. 5 that attackers are also refining ClickFix campaigns targeting macOS computers. In one campaign, fraudulent websites instructed users to copy and run commands through Terminal to install information-stealing malware. Microsoft identified more than 250 front-end domains associated with the campaign during its monitoring period.

The company said ClickFix can be particularly effective because the victim performs the critical steps needed to execute the malicious command. That can allow the attack to bypass some conventional security protections.

The Canadian Anti-Fraud Centre advises people to be cautious around websites that attempt to install malware, keep operating systems and antivirus software up to date and verify website addresses before entering personal information. Canadians should also use unique passwords and enable multi-factor authentication on important accounts.

Fraud remains a significant problem across the country.

The Canadian Anti-Fraud Centre received more than 112,000 fraud reports in 2025 involving more than $704 million in reported losses. Identity fraud accounted for 8,403 reports while investment fraud produced the largest reported financial losses at $351 million.

Anyone who encounters an unusual CAPTCHA or verification page should stop if it asks them to enter keyboard commands, paste code, download software or change computer settings.

People who believe they have already followed fraudulent instructions should secure their accounts, change compromised passwords and contact their financial institution if banking information may have been exposed.

The Canadian Anti-Fraud Centre says victims should also report the incident to local police and through Canada's national fraud and cybercrime reporting system.