A fake CAPTCHA scam is a web page that pretends to check whether you are human, then talks you into pasting a command into your own computer. That command lets an attacker in. It has become one of the most common ways criminals get into companies, and it works on small businesses just as well as it works on large ones.
Last month, The Hacker News published an analysis with a useful lesson for owners. Attackers mostly look for methods that are cheap, easy to repeat and reliable across thousands of companies, and they keep using them for as long as they work. This trick, which security teams call ClickFix, fits that description perfectly. Here is how it works, why your existing protection often misses it, and what to ask the people who run your IT.
What a Fake CAPTCHA Scam Looks Like on an Ordinary Workday
Picture an employee looking up a supplier’s website or clicking a link in a search result. The page shows a familiar box asking them to confirm they are not a robot. So far, nothing seems unusual.
Then the box asks for a little more. It gives three short steps: hold down two keys, paste, press Enter. The instructions look like a routine check, and most people follow them without a second thought, because the page looks legitimate and the whole thing takes five seconds.
What the employee does not see is that the page has already copied a command onto their computer. When they paste it and press Enter, the computer runs that command as if the employee had typed it. In most cases, it quietly downloads a program that gives the attacker access or steals saved passwords.
Some versions skip the robot check and show a fake error instead, such as a document that will not open or a video call that cannot reach the microphone. However, the request at the end is always the same: paste this and press Enter.
Why Your Antivirus Lets It Through
Most of the protection a small business pays for is built to catch something arriving from outside. That usually means a dangerous attachment, a known bad file or a flaw in software that needs an update.
A fake CAPTCHA scam avoids all three. Nothing arrives as an attachment, so there is nothing to scan when an email lands. No software flaw is involved, so there is nothing to patch. And the command is started by a real employee, signed in normally, on a company computer. To the computer, it looks like ordinary work.
That is why this scam is so hard to stop with tools alone. The decisive moment happens in someone’s head, in the few seconds between reading “paste this” and pressing Enter.
Why Attackers Keep Using the Same Trick
From a criminal’s point of view, the fake CAPTCHA scam has everything going for it. It costs almost nothing to set up, and it does not depend on finding a weakness in your particular systems. Better still for them, it can be copied onto thousands of websites at once.
Microsoft has reported that ready-made kits for this scam are sold to criminals by subscription, the same way a business pays for software. As a result, whoever buys the kit does not need real technical skill. What they need is traffic, meaning enough people landing on their pages, and they get it through hacked websites, fake ads and rigged search results.
This is the part owners tend to underestimate. A 40-person company does not need to look interesting to get caught. It only needs one employee to land on one of those pages on a busy afternoon.
How Often Attacks Start With Something an Employee Does
Microsoft published its 2026 Digital Defense Report on October 1. It looked at how attackers first got into the organizations Microsoft observed between July 2025 and June 2026. In about 3 cases in 10, the way in was an employee running something they had been tricked into running, which is exactly what a fake CAPTCHA scam asks for.
Read that number honestly, though, because it is not directly your number. Microsoft’s data comes mostly from larger organizations that already have security teams and monitoring in place. What does transfer to a smaller company is the mechanism. If the trick works on companies with full-time security staff, a company with no IT department of its own has every reason to take it seriously.
What Happens After the Paste
Once the command runs, attackers rarely bring in anything dramatic. Instead, they tend to use the administration tools already installed on Windows and Mac computers, the same tools your IT provider uses to manage your machines. Because those tools are legitimate, their activity blends in with normal work.
From there, the goals are usually simple. Attackers steal the passwords saved in the browser, take over email accounts, look for invoices and payment details, and set up a way to come back later. In the worst cases, the access is sold to a ransomware group, and the company finds out when its files are locked.
The longer nobody notices, the more the intrusion costs. An attack spotted within the hour often means one laptop to clean up. An attack spotted three weeks later can mean a compromised mailbox, payments redirected to a fraudster and a long conversation with your customers.
What This Means for a Company Without an IT Department
For an owner, the risk comes down to three questions: can this happen to us, what would it cost, and who would notice.
It can happen, because the scam only needs one person and one web page. The cost depends almost entirely on speed. And the third question is the one most small companies cannot answer. If one laptop started behaving strangely at 2 a.m. on a Saturday, would anyone see it before Monday?
None of this requires you to become technical. It does require you to know which questions to put to the people who manage your computers, and what a good answer sounds like.
Questions to Ask Your IT Provider About This Scam
- Can our employees run commands they paste from a web page? Most staff never need to. A good answer explains that pasted commands are blocked or restricted for people whose job does not require them, and names the setting that does it.
- Who on our team has administrator rights on their computer? The answer should be a short list, with a reason for each name. When everyone is an administrator, the scam has far more room to work.
- Would we notice if a computer started using administration tools in an unusual way? Ask who receives that alert, and whether anyone looks at it outside office hours.
- What happens in the first hour after someone reports a mistake? A good provider can describe the steps without hesitating: isolate the computer, check the accounts, reset what needs resetting.
- When did we last remind staff about fake verification pages? If the answer is never, that is the cheapest fix on this list.
What to Tell Your Team This Week
The single most useful sentence you can give your employees is this one: no real website will ever ask you to paste something into your computer to prove you are human.
Say it at your next team meeting, and add the second half, which matters just as much. If someone already pasted something, they should tell you or your IT provider right away, and nobody will be in trouble for it. People hide mistakes when they expect to be blamed, and a hidden mistake gives the attacker days instead of minutes.
If Someone Already Pasted Something
Speed matters more than perfection here. First, have the employee disconnect the computer from the network, either by unplugging the cable or turning off Wi-Fi, and leave it switched on so your provider can examine it. Then call your IT provider immediately, rather than sending an email that might sit until tomorrow.
Next, from a different and clean device, change the passwords for that person’s email and for any business accounts they use, starting with banking and payroll. Finally, ask your provider to confirm in writing what they found and what they changed, so you have a record if a customer or an insurer asks later.
A Simple Trick Deserves a Simple Defense
The fake CAPTCHA scam succeeds because it is ordinary. It shows up on everyday websites, asks for five seconds of cooperation and leaves nothing for traditional tools to catch. Fortunately, the defense is ordinary too: one sentence your team remembers, a few settings your provider can switch on, and someone who is actually watching when an alert goes off.
