The decisive warning is not the copied CAPTCHA design—it is the instruction chain that leaves the browser and ends in a system command.
The scenario
A visitor sees a familiar human-verification screen. Instead of completing an interaction inside the webpage, the page tells them to press keyboard shortcuts, open Windows Run, Terminal or PowerShell, paste clipboard content and press Enter.
What makes this high confidence
Logos, checkboxes and “verify you are human” wording are easy to copy and are weak evidence alone. The combination of a verification pretext, clipboard activity, operating-system instructions and command-like content is far stronger because a legitimate CAPTCHA does not need the visitor to run a system command.
What Radar should retain
- The strongest screenshot after the unsafe instructions appear.
- The clipboard event and a shortened, non-executable explanation of its content.
- Any remote host or file name referenced by the command.
- The timing and interaction that revealed the malicious stage.
False-positive boundary
Developer documentation may legitimately mention PowerShell or include copy buttons. It should not be classified as ClickFix unless the surrounding page uses a deceptive verification or repair pretext and directs the visitor to execute the copied content.
Recommended response
Close the page without following its steps. If the command was run, disconnect the device from sensitive networks and contact the appropriate security team. Preserve the URL and event time, but do not rerun the command to collect evidence.
Reference: Microsoft Threat Intelligence’s analysis of the ClickFix technique.