Comments
Hacker News
I ran into the same thing on a cooking blog (which I had visited many times before) a few weeks back. I was pretty mystified but like you, spidey sense kept me from running the code. It's insidious because it looks like it's coming from Captcha. I do have uBO Lite running on Chrome. Tried the website in Firefox and also got the same manual run thing.
I wasn't sure what to do about it. Obviously I was unable to notify the blog owner. I came back to the website about a week later and it didn't come up again.
by fallinghawks
This exact technique has been around for a while; there are even government resources warning about it (e.g. https://www.michigan.gov/msp/divisions/intel-ops/cyber/mc3/c... - April 2025).
As you might imagine, these attacks are aimed at less sophisticated users who may have no idea what Win+R even does, and who might be tricked into believing that this actually has anything to do with website verification.
The site you visited -- or one of the resources it depends on -- might have been compromised. If you're enterprising, you could probably determine where the malicious script is getting loaded from by looking in the page source.
by nneonneo
this is wildly complex, way more so than a traditional ClickFix attack. it's fetching JS scripts from a Ethereum/Base contract and executing them - i've never seen something like this before
by bstsb
Do you have any browser extensions enabled?
I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.
by c0n5pir4cy
Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.
by Retr0id
> How do you protect yourself
Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.
If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.
by Good4boothee
Not directly answering your questions, but I just wanted to say: Great instincts!
You saw something unusual, then
1. Stopped what you were doing.
2. Investigated to see if this was legitimate or malicious.
3. Identified a place to asked others about it.
4. Formulated a good question with enough background information to help people answer it.
All around good job! Well done.
by kstrauser
This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...
by everdrive
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I ran into the same thing on a cooking blog (which I had visited many times before) a few weeks back. I was pretty mystified but like you, spidey sense kept me from running the code. It's insidious because it looks like it's coming from Captcha. I do have uBO Lite running on Chrome. Tried the website in Firefox and also got the same manual run thing.
I wasn't sure what to do about it. Obviously I was unable to notify the blog owner. I came back to the website about a week later and it didn't come up again.
by fallinghawks - This exact technique has been around for a while; there are even government resources warning about it (e.g. https://www.michigan.gov/msp/divisions/intel-ops/cyber/mc3/c... - April 2025).
As you might imagine, these attacks are aimed at less sophisticated users who may have no idea what Win+R even does, and who might be tricked into believing that this actually has anything to do with website verification.
The site you visited -- or one of the resources it depends on -- might have been compromised. If you're enterprising, you could probably determine where the malicious script is getting loaded from by looking in the page source.
by nneonneo - this is wildly complex, way more so than a traditional ClickFix attack. it's fetching JS scripts from a Ethereum/Base contract and executing them - i've never seen something like this beforeby bstsb
- Do you have any browser extensions enabled?
I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.
by c0n5pir4cy - Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.by Retr0id
- > How do you protect yourself
Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.
If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.
by Good4boothee - Not directly answering your questions, but I just wanted to say: Great instincts!
You saw something unusual, then
1. Stopped what you were doing.
2. Investigated to see if this was legitimate or malicious.
3. Identified a place to asked others about it.
4. Formulated a good question with enough background information to help people answer it.
All around good job! Well done.
by kstrauser - This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.
The attack is basically getting someone to accidentally run malicious code.
- ctrl + R brings up the Windows "run" dialogue.
- the code executes a powershell command that reaches out to a remote server
- if successful, the remote server answers and you have installed a dropper or something.
Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.
https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...
by everdrive