Nick PerryFounder and CEO of 7 Figure Cartel

The Fake CAPTCHA Scam That Can Hack Your Computer in Seconds

10 Mar 2026 · 1 min

Watch on YouTube

0:45

In this video, cybersecurity educator Nick Perry exposes a new phishing technique called "ClickFix" that masquerades as a legitimate CAPTCHA verification box. Attackers copy the look of Google or Cloudflare CAPTCHAs and instruct users to run system shortcuts such as Windows+R followed by Ctrl+V (or Command+Space on macOS) to "prove" they are human. The shortcut opens the Run dialog, pastes a malicious command, and silently installs malware that can steal passwords, browser data, cryptocurrency wallets, and grant full system control. Perry emphasizes that the threat does not require downloading a file; the user’s own keystrokes execute the payload. He warns viewers to never run keyboard commands as a verification step, especially those involving system launchers, and to treat any request to type commands as a potential compromise.

Chapters

What if I told you that you could get hacked just by proving you're not a robot online? Here's how. You know those little boxes that ask you to prove you're human? Yeah, well, some sites are faking them because instead of picking traffic lights, they say, "Press Windows+R and Ctrl+V." Sounds simple, but what you just did was run a command that silently installed malware on your computer. The scam is called ClickFix. It gives attackers access to your passwords, browser data, and crypto wallets, even full control of your system. And it looks real. It copied the Google CAPTCHA or Cloudflare CAPTCHA exactly. It's not malware you download, it's the malware you type in and install yourself. So here's what to remember: if a site ever tells you to run keyboard commands to verify something, don't, especially anything with Windows+R or Command+Space, because the "I'm not a robot" box might be the thing that hands over your entire device.