ClickFix: the fake “verify you’re human” check

A page asks you to prove you’re human by pressing a few keys and pasting something. Doing it runs a command that installs malware.

What it looks like

Email · Booking.com · Reservations

A guest left a complaint about your booking. To view it, verify you're human: press Windows + R, paste the code and press Enter.

How it usually ends

It was ClickFix. The 'CAPTCHA' put a command on your clipboard, and pasting it installed an info-stealer that took your saved passwords.

Red flags

Fake CAPTCHA asks you to run a command
Brand notification pattern: review, booking, verification
Page is not on booking.com

A real case

From December 2024 Microsoft tracked fake Booking.com emails to hotel staff that led to a ClickFix page installing XWorm, Lumma and other malware.

What to do

No real CAPTCHA ever asks you to open Run, Terminal or PowerShell.
Close the page and open the service’s app or site yourself.
If you already pasted it, disconnect and tell IT straight away.

Could you spot it in the moment?

In Painted Sky you’re born at random somewhere on Earth and live a whole life — and this scam is one of the fakes that can find you. Make the call yourself, then replay the same life with a lens that shows what was fake.

Play Painted Sky — free →