ClickFix and fake CAPTCHA scams

Legitimate university services will never require you to run commands to access content or verify you’re a human.

Spotting ClickFix attacks

Some ClickFix attacks use a fake verification page or an error message containing instructions designed to convince you to take additional actions. The examples below illustrate how a ClickFix attack may appear.

If a website asks you to do any of the following, stop immediately:

• Press Windows + R (which opens the Windows Run dialog) and CTRL + V (to paste), or
• Open PowerShell or command prompt and CTRL + V or right-click (to paste), or
• Open the terminal on macOS (for example by using Spotlight search, Launchpad, Finder, or Applications > Utilities), and then use paste commands to "verify" yourself.

ClickFix attacks can appear in a variety of ways such as:

• Fake CAPTCHA checks
• Fake Cloudflare verification pages
• Fake Microsoft sign-in troubleshooting pages
• Fake document viewer prompts
• Fake browser update messages
• Fake Zoom or Teams meeting access checks

These fake verification pages can appear in many places online, including emails, social media, online adverts, search results, and websites that have been taken over by cyber criminals. Regardless of how you arrive at the page, never follow instructions to run commands on your device.

What can I do?

If you encounter a suspicious message, email, or website directing you to a fake verification page, please use the reporting methods below so the Information Security Team can investigate and protect others.

Teams

If you receive a suspicious message in Microsoft Teams, use the Report option within Teams to alert the Information Security Team.

1. Go to the chat message and select More options ... > Report this message.
2. Choose the reason why you want to report the message. For example, use Security concern for reporting spam, phishing, or malicious content‌.
3. Select Report. You'll receive a message confirming your report was sent.

Emails

Use the Report Phishing button in Outlook.

Once reported, please do not delete the email. Keeping the message available allows the Information Security Team to investigate the reported content, identify any threats, and take appropriate action where necessary.

Websites

Report it as a security incident on Beacon.

Where possible, include:

• The website address (URL)
• A brief description of your concerns
• Screenshots of any suspicious content or messages
• Any information about how you reached the suspicious website or verification page

If you interacted with the page or followed any instructions, clear your browser’s cookies and cache, close and restart the browser, and then sign back in to University services as required.

Remember: If a website asks you to copy and paste commands into PowerShell, Command Prompt, Terminal, or the Windows Run box, treat it as suspicious and report it using the relevant method for reporting as described above.

Be especially cautious of messages that create a sense of urgency, such as claims that your account will be blocked, access will expire, or immediate action is required. Cyber criminals often use urgency to pressure people into acting without thinking.