ClickFix: the fake captcha that asks you to paste a command and steals passwords

You visit a website and a box appears that looks like a captcha. It says you need to verify you are human and gives you three steps: press the Windows key and R, press Control and V, press Enter. It looks like just another check, one of the many around the Internet. It is not. You have just run a command on your computer that someone copied to your clipboard.

This is the attack known as ClickFix, and it has become very common on compromised websites, online stores included.

How it works

1. The website is compromised. Someone has injected JavaScript into a template, a module or a theme file.
2. The script displays a full-screen overlay that looks like a captcha or a verification error, sometimes imitating the style of well-known services.
3. When the button is clicked, it copies a command to the clipboard without the user seeing it. It is usually a PowerShell command or another system tool that downloads and runs a program.
4. The instructions get the user to run it themselves in the Windows Run dialog. Some variants ask Mac users to open the terminal.
5. The downloaded program installs itself, usually an infostealer.

What it is after

The target is not the store's server: it is the computer of whoever visits it. What gets installed is usually designed to steal:

• Passwords saved in the browser.
• Session cookies, which allow access to accounts without the password and sometimes bypass two-factor authentication.
• FTP client profiles with their passwords.
• Cryptocurrency wallets and autofilled form data.

Now think about who visits your store more than anyone: you and your team. If the fake captcha appears in the back office or on the store while you are managing it, what gets stolen are the credentials for the hosting panel, FTP, company email and the back office itself. It is a very effective way to turn a small infection into full control, and it explains some FTP compromises that leave no trace in the web logs.

For your customers, the damage is different: their data is stolen on their own machine through your website. Besides the problem for them, it is a reputational problem and, depending on the case, one of notification obligations.

How to recognise it

As a visitor, there is one simple rule your whole team should know:

No legitimate verification asks you to open the Run dialog, the terminal or PowerShell and paste something. Not Google, not Cloudflare, not any bank. If a captcha gives you keyboard instructions, it is an attack. Close the tab.

Other signs:

• The supposed captcha appears on a website that never had one before.
• It takes up the whole screen and hides the website underneath.
• It mentions "DNS verification" errors, "browser update" or similar.
• Something is copied to the clipboard without you pressing any copy button.

If someone on your team has already run it: disconnect that computer from the network, do not use it to log into any service and, from another clean machine, change the passwords of everything stored on it and close open sessions. Afterwards, the affected machine needs professional cleaning or reinstalling.

How to tell whether your store is serving it

The script may only be shown to some visitors: only on Windows, only on the first visit, only from certain countries or only to those not identified as administrators. That is why opening the store and seeing nothing is not enough.

• Check the JavaScript files of the theme and modules for recent changes, especially very long lines added at the beginning or end.
• Check the theme templates in case a <script> tag loading something external has been added.
• Look at the settings of modules that let you insert HTML (custom blocks, code fields in the header), because the injection may be in the database rather than in a file.
• Test from a clean browser, in a private window and logged out, and from a mobile phone.
• Listen to your customers. A report of "I got a strange captcha" should be taken seriously.

If you find it, remember that the script is the consequence, not the cause. Someone had access to put it there: you have to find the door they came in through, as with any other infection, and close it. Keeping PrestaShop and its modules up to date greatly reduces the ways someone can inject a script like this.

Bear in mind too that these scripts tend to change often: the same loader requests its content from an external server each time, and what is a fake captcha today may be a browser update notice or a payment form tomorrow. That is why removing the box you saw is not enough: you have to remove the loader and find out how it reached your files or your database.

What to tell your team

• Never paste anything into Run, PowerShell or the terminal because a website asks you to.
• Do not save FTP or panel passwords in the browser or in the FTP client.
• Use two-factor authentication in the back office, the hosting panel and email.
• Report anything odd they see on the store straight away, even if it seems minor.

How to solve it in PrestaShop

RKR Security Alert includes a sentinel that inspects the page as rendered in the browser, where injections that leave no trace on disk show up. Against ClickFix it monitors clipboard writes: it alerts when a website writes to it without the user having first pressed a copy button, and whenever what is copied is a system command, and it also detects the full-screen overlay asking you to open the Run dialog. It has been tested not to trigger on cookie banners, newsletter pop-ups or Google's legitimate reCAPTCHA. On the server, its scanner looks for injected JavaScript and watches for changes to files and templates, so you can also find how the script got in.