Is your own site showing visitors a fake CAPTCHA? What a ClickFix injection looks like from the owner's side

osec.one guide cover: is your own site showing visitors a fake CAPTCHA?

The short version

• What visitors see: a "Verify you are human" box. Click it, and the page copies a command to the clipboard and says: press Win+R, then Ctrl+V, then Enter.
• What that does: runs PowerShell (or mshta, or curl | sh on a Mac) that installs an infostealer such as Lumma or Vidar on the visitor's PC.
• Who serves it: ordinary sites that were hacked. A bakery, a dealership, a club. Not the attacker's own domain.
• Why owners miss it: the box often shows only to first-time visitors on Windows, never to a signed-in admin.
• What osec Scan does: reads your page's scripts and flags the three parts of the lure together. Free, paste a URL, no sign-up.

How big this is

• June to September 2024: GoDaddy found fake plugins on more than 6,000 WordPress sites, installed with stolen admin passwords in one automated POST request each.
• February 2025: Sekoia counted at least 9,300 sites serving the ClearFake chain, now with fake reCAPTCHA and Cloudflare Turnstile boxes.
• Same period: over 100 car dealership sites showed the lure through one shared third-party video service, without their own sites being hacked.
• Microsoft, August 2025: ClickFix is one of the most common first steps it sees, used by crime groups and state actors alike.

How the script gets into a site

1. A fake plugin. Names that look real: "Wordfence Security Classic", "LiteSpeed Cache Classic", "Universal Popup Plugin", "SEO Booster Pro". It hooks into WordPress and prints a script tag on every page.
2. Theme or template files. A line added to header.php, footer.php or the theme's functions.php.
3. The database. A script stored in a widget, a post, or an option such as the site's custom header code. Nothing changes on disk.
4. A tag manager. A new tag in your Google Tag Manager container, added by anyone who has the container's password.
5. A script you load from someone else. A chat widget, video player or analytics vendor that was hacked. The dealership case.
6. A blockchain loader. ClearFake's injected script is small: it fetches the real lure from a Binance Smart Chain contract, so the visible line looks harmless and the lure can change without touching your site.

The three signs Scan looks for

• A clipboard write: navigator.clipboard.writeText, document.execCommand('copy') or clipboardData.setData.
• A command line that fetches and runs something: PowerShell with -w hidden, iex, iwr or -enc; mshta https://...; cmd /c with curl or certutil; msiexec with a URL; curl ... | sh. Split strings ("pow" + "ershell") are joined and base64 literals decoded first.
• The instruction a real site never gives: "press Win+R", "Ctrl+V then Enter", "open the Run dialog and paste", or a fake "reCAPTCHA Verification ID" comment on the end of the command.
• Where it looks: the page's inline scripts and event handlers, plus up to 12 scripts the page loads (your own and third-party). GET requests only.

Reading the result

All three signs: a finding

osec Scan result row: No clipboard lure check failed, minus 10 points, with the script that writes to the clipboard, the PowerShell command and the fake verification comment, followed by four clean-up steps — osec Scan's real lure check run on a test page we built with an inert copy of the lure (the address is .invalid and never resolves). Minus 10 points and the clean-up steps.

• What it means: a script on your page copies a command and tells visitors to run it. Treat the site as compromised.
• 10 points off the grade, and the four clean-up steps below the row.
• The row names the script: "inline script on the page" or the URL of the file that holds it. Start there.

Two of three: have a look

osec Scan result row with an amber mark: worth a look, not proof, a script writes to the clipboard and holds a curl pipe to sh command — Two signs on a test docs page with a Copy button for an install command: amber, no points taken.

• Usually innocent: a docs page with a Copy button next to curl ... | sh looks exactly like this.
• No points taken.
• Check: do you recognise the script and the command? If not, treat it as a finding.

Nothing found

osec Scan result row with a green tick: no clipboard lure in 1 script read — A live scan of osec.one: no lure in the scripts read.

• Good, not proof. Scan reads what your page itself loads.
• It can't see: scripts loaded by other scripts (ClearFake's blockchain step), lures shown only to some visitors (by country, browser, or first visit), or pages other than the one you scanned.
• So also scan: your home page, a blog post, and the contact or checkout page. And do the owner's checks below.

Owner's checks, in ten minutes

1. Open the site in a private window on a Windows PC or a phone, not signed in. Look for any "verify" box.
2. WordPress, Plugins page: anything you didn't install, or a copy of a real plugin with "Classic" or "Pro" added?
3. Users page: any administrator you don't know?
4. Theme files: search header.php, footer.php and functions.php for <script lines you didn't add.
5. Tag manager: open the container's version history. Any tag you didn't publish?
6. View source on the live page: list every script URL. You should know who each one belongs to.

Clean-up, in order

1. Take the script out now. Plugin, theme line, database entry or tag. Visitors are being infected while it's there.
2. Find how it got in. Update WordPress, the theme and every plugin. Delete plugins and admin users you don't recognise.
3. Change every password that could reach the site: WordPress admins, hosting panel, FTP/SFTP, database, tag manager. Unique ones. The 6,000-site wave used stolen admin passwords.
4. Rotate keys kept in the site's config (wp-config.php salts, API keys, SMTP passwords).
5. Add a Content-Security-Policy with reporting, so the next unknown script is blocked and you get a report instead of a surprise.
6. Scan again and keep a weekly scan.
7. Tell visitors if the lure was live for a while: anyone who ran the command should treat their PC and saved passwords as stolen.

Stop the stolen-password route

• Admin logins on most hacked sites were real passwords, bought from infostealer logs or guessed.
• Remove the password: sign in to your own admin pages with an email code, Google or Apple via osec Auth. Free, no OAuth setup on your side.
• Watch the login page: osec Login Protection counts wrong codes and emails per account, not just IPs.

• The visitor's side and the stealer: Lumma Stealer: a $250-a-month infostealer, fake CAPTCHAs and the takedown that lasted weeks.
• When a trusted third-party script turns: Polyfill.io: when a trusted script tag turned against 380,000 sites.

Paste your URL into osec Scan: the clipboard-lure check runs with 15 other checks (headers, TLS, exposed login pages) in about ten seconds. Free, no sign-up.

Scan your site

Sources: BleepingComputer: over 6,000 WordPress sites hacked to install plugins pushing infostealers (GoDaddy research, 21 October 2024); The Hacker News: ClearFake infects 9,300 sites, uses fake reCAPTCHA and Turnstile (Sekoia research, 19 March 2025); Microsoft Security: Think before you Click(Fix), analyzing the ClickFix social engineering technique (August 2025); Darktrace: ClearFake, from fake CAPTCHAs to blockchain-driven payload retrieval; osec Scan clipboard-lure check (CR-0187).