Data by urlscan.io opens in a new tab

ClickFix gets the victim to run the command themselves. A page shows a fake CAPTCHA, update prompt or error, quietly copies a payload to the clipboard, and walks the reader through pasting it into the Run box or a terminal. The site doing the asking is usually a legitimate one that has been compromised, which is what makes it convincing. Every site here is rechecked every fourteen days, and cleaned ones come off.