What is ClickFix
Since early 2026, a new attack method has been making the rounds that catches even experienced IT professionals off guard: ClickFix. The concept is deceptively simple but devastatingly effective – cybercriminals compromise ordinary websites and replace their content with a fake CAPTCHA that looks remarkably like a Cloudflare verification dialog demanding “human verification,” except the so-called verification involves running a malicious command on your own machine.
The BACS is currently warning about over 100000 compromised websites worldwide, with the number of affected sites in Switzerland growing steadily.
How the attack works
Visitors to a compromised website see a Captcha window instead of the expected content, complete with the familiar message “Verify you are human” – but what follows is anything but familiar, because the dialog instructs you to press Windows key + R (which opens the Run dialog) and paste a command that has been silently copied to your clipboard. On macOS, theres an adapted variant that targets the Terminal instead.
The pasted PowerShell command then downloads additional malware, with the attackers employing a technique called “EtherHiding” that stores the actual malicious code on the blockchain via so-called RPC providers, which makes detection particularly difficult because blockchain content simply cannot be deleted…
The end result is usually the Vidar infostealer landing on your machine, which harvests passwords, credit card data, browser cookies and crypto wallets all in one sweep (all because someone thought they needed to prove they weren’t a robot).
Why WordPress
The fact that most affected sites run WordPress is no coincidence: in early July 2026, two critical vulnerabilities became public that are collectively known as “WP2Shell” (CVE-2026-63030 and CVE-2026-60137), and even though WordPress released security patches on July 17th, many operators still haven’t applied them to this day.
The problem extends further still, because when an attacker compromises a single WordPress site on shared hosting, they can often take over the other sites on the same server as well, which mainly affects smaller hosting providers that don’t properly isolate their customer accounts from each other. Since May 2026, a large-scale campaign called “StopAndProtect” has compromised thousands of WordPress sites simultaneously, not just for ClickFix but also for ransomware distribution and data theft.
Protection for visitors
The most important rule can be reduced to a single sentence: no website in the world needs a PowerShell command to confirm you are a human being. If a CAPTCHA asks you to press key combinations or paste commands, close the tab immediately, because whatever that site wants from you, it certainly has nothing to do with verificaton.
Current antivirus software detects most Vidar variants, though not all of them, and browsers with active Safe Browsing often warn you before the page has even finished loading.
Protection for site operators
Anyone running a WordPress site should update urgently, since the WP2Shell patches have been available since July 17th, while also enabling two-factor authentication for the admin area and checking whether the hosting provider actually isolates sites from one another.
Outbound connections to RPC providers (e.g. Ethereum endpoints) should be blocked on the server if they are not needed, as this effectively disables the EtherHiding mechanism through which the malicious payload gets downloaded.
If you are unsure whether your own site might be affected: that is exactly the kind of assessment we offer, from vulnerability assessments to web application pentests.
More information from the BACS.
And whether your WordPress plugin is really secure…