TL;DR: Some websites now show a fake "verify you’re human" check that tells you to copy a command and paste it into your computer, often by pressing a key combo and hitting Enter. ANZ warned about this in June 2026: running it installs harmful software. A real CAPTCHA asks you to click boxes or pick pictures. It never asks you to run anything. If you did it, disconnect and get the device checked.
What it looks like
ANZ’s June 2026 alert describes fake verification pages that ask you to copy and paste a command to prove you’re human. That command installs harmful software.
Typically the page says something like:
- "Verify you are human"
- "Press [key] + R", then "Ctrl + V", then "Enter"
- Sometimes it silently copies the command for you when you click a button
Security researchers call this style of attack ClickFix.
Why it fools smart people
- CAPTCHAs are annoying and familiar, so we do what they say without thinking.
- The instructions are short and technical-looking. It feels like IT, not crime.
- The page may look like a site you trust, reached from a search ad or a link in an email.
Here’s the tell: no website needs you to open a system box and run code to prove you’re a person. A robot could do that faster than you anyway.
What the malware can do
Pasted commands can download software that steals saved passwords, browser cookies, banking sessions and crypto wallets, or lets attackers control the device. That’s how a "quick check" turns into an emptied account.
If you already ran it
- Disconnect from the internet (Wi-Fi off, cable out).
- From a different, clean device, change passwords for email and banking, and sign out of all sessions.
- Call your bank. Tell them your device may be compromised.
- Get the computer scanned or professionally cleaned; consider a full reinstall.
- Turn on MFA everywhere (guide).
- Report it to ReportCyber at cyber.gov.au.
Avoid it next time
- Never paste anything a website tells you to into a Run box, Terminal or PowerShell.
- Be wary of sponsored search results for banks, software downloads and government services.
- Keep your OS and browser updated.
More scams in our ANZ 2026 alerts roundup. A free exposure check shows whether your email already appears in breach data.
Frequently Asked Questions
Will a real CAPTCHA ask me to paste a command?
No. Real human-verification checks ask you to click boxes or pick images, never to run a command.
What happens if I paste the command from a fake verification page?
ANZ warns it installs harmful software, which can steal passwords and banking sessions.
What should I do if I ran a command from a fake CAPTCHA?
Disconnect, change passwords from a clean device, call your bank and get the computer checked.
What is ClickFix?
A name security researchers use for scams that trick people into running malicious commands themselves, often via fake verification pages.