ClickFix: the scam that gets you to run the malware yourself

You're on a website and a box appears. Verify you are human. Or Error rendering this page — run the fix below. It gives you three tidy steps: press Windows + R (or open Terminal), paste, and hit Enter. It looks like a routine tech fix.

It isn't. The thing you just pasted is a command that quietly downloads and runs malware. There was no exploit, no software vulnerability, and no warning from your antivirus — because you ran it, by hand, with your own permissions. Security researchers call this ClickFix, and in 2026 it is one of the most common ways both Macs and Windows PCs get infected.

Scouter Browser Defense is a free, open-source browser extension that stops it. Here's the attack, and how the extension breaks it.

Why it works

Antivirus is built to distrust files that arrive on your machine. It is not built to distrust you. When you open a terminal and run a command yourself, the operating system assumes you meant to — that is the whole point of having a terminal.

The scam's genius is that it never attacks the computer. It attacks the person. The fake "verify you are human" page, the official-looking error, the numbered steps — all of it exists to get a real human to paste one line and press Enter. By the time anything runs, the malware is executing as you, and most defenses have already waved it through.

The one moment that gives it away

Here is the tell. For the paste step to be easy, the page has to put the command on your clipboard for you. That clipboard write — a web page silently copying a shell-command-shaped payload — is the moment the attack commits. It is also the moment it becomes catchable.

What Scouter Browser Defense does

• ClickFix commands. The instant a page copies a command-shaped payload to your clipboard, you get a loud, unmissable warning and a one-click button to clear your clipboard — before you can paste it into Terminal, PowerShell, or the Run box.
• Fake-CAPTCHA and "fix this error" lures. It flags the decoy pages themselves — the "verify you are human" and "fix this error" screens that set the scam up in the first place — so you're warned before you ever get to the paste step.
• Phishing logins. It warns you when a page asks for your password on an untrustworthy web address, so a look-alike site doesn't walk off with your credentials.

It collects nothing

There is no account, no sign-up, and no servers. On its own, the extension makes no network requests at all. It inspects a page's clipboard write only to judge whether it looks like a command — in the page, never stored — and it never reads the things you copy yourself. Your browsing stays yours.

Even better with the agent

If you also run the free, open-source Scouter agent on your computer, you can pair the extension with it over localhost. A flagged site then gets checked against live malware blocklists, and you can block it across your whole device with a single click — reversibly, so nothing is permanent.

Get it

Scouter Browser Defense is now on the Chrome Web Store — add it to Chrome in one click. It works in Chrome, Edge, and Brave. A Firefox listing is on the way; until then you can load the Firefox build yourself from the source. Everything is free, Apache 2.0, and the full code is on GitHub.

The best time to catch this scam is the moment the command hits your clipboard — not after you've pressed Enter.