ClickFix
Also called fake CAPTCHA, paste-and-run scam
A trick where a web page or video tells you to copy a command and paste it into your computer, which then installs malware.
ClickFix turns you into the installer. A web page shows a fake CAPTCHA or an error with a "fix" button; clicking it quietly copies a command, and the instructions tell you to paste it into a box on your computer and press Enter. That command downloads malware, often an infostealer that grabs your saved passwords and logged-in sessions.
It spread fast because it's cheap and works. Microsoft saw it on more than a million devices in a few months of 2026.
AI pushed it further. Microsoft described AI-made TikTok videos, with synthetic narration and no human on screen, showing fake software "activation" steps that ended in a malicious command; some had around half a million views. Making each video cost almost nothing.
For example
A "verify you're human" box says: press Windows+R, paste with Ctrl+V and press Enter. That runs the attacker's command.
Put it to use
Where you'll meet clickFix in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.