11:15AM, 2 September 2026
TLP Rating:
Compromised Websites Serving ClickFix Pages
ClickFix is a social engineering technique that presents visitors to compromised websites with fake CAPTCHA or Cloudflare Turnstile pages instructing them to run malicious commands, leading to the installation of infostealers or other malware on their devices. ClickFix campaigns commonly use compromised WordPress websites to deliver their malware.
If a website is serving a fake CAPTCHA or Cloudflare verification page, the website owner’s priority is not only to remove the visible prompt, but also remediate their compromised website, identify the original vector of compromise, and eliminate any persistence mechanisms that will reinfect the site.
Remediating an infected website requires some technical knowledge. If you do not feel comfortable taking these actions yourself, we recommend you immediately take the site offline, reset your WordPress credentials, and then contact a local IT service provider to assist you.
What to look for
How to tell if you're affected
Confirm the Infection
Common indicators include:
- A fake Cloudflare "Verify You Are Human" page.
- Fake CAPTCHA or browser update prompts.
- Full-screen overlays appearing shortly after page load.
- JavaScript that copies PowerShell, Terminal, or shell commands to a visitor's clipboard.
- Behaviour only affecting real browsers, while scanners and search-engine crawlers see a clean page.
Test from Multiple Sources
Attackers frequently hide malicious content from:
- Search-engine crawlers
- Security scanners
- Headless browsers
Test using:
- A normal browser session
- Incognito/private browsing
- Different IP addresses
- Mobile and desktop devices
Analysis indicates that some ClickFix variants selectively target Windows and macOS browser user agents while presenting clean content to automated scanners.
What to do
Prevention
Implement Long-Term Hardening
WordPress Security
- Keep WordPress core updated.
- Remove unused plugins and themes.
- Monitor plugin advisories.
- Disable file editing from the WordPress dashboard.
Access Control
- Enforce MFA.
- Apply least-privilege administration.
- Regularly audit accounts.
Monitoring
Implement:
- File integrity monitoring
- Vulnerability scanning
- Centralized logging
- Security alerting
Microsoft notes that ClickFix campaigns can evade traditional automated detection because they depend on user interaction, making user awareness and layered technical controls important defensive measures.
Mitigation
For full details on how to mitigate, read the mitigation document below.
More information
Recommended Recovery Statement
If visitors may have been exposed, consider communicating:
“Our website was found to contain unauthorized code displaying a fraudulent verification prompt. The issue has been removed and the affected systems have been remediated. Visitors who interacted with the prompt should not execute any commands that were copied to their clipboard and should immediately run endpoint security scans, reset passwords, and review their devices for signs of compromise External Link .”
If you require more information or further support, submit a report on our website.
Report an incident External Link