Victim triage
If a web page told you to paste something
Written by Antonio Radu. Something wrong or out of date? corrections@clickfixreport.com
Pick the line that matches what happened. Each guide leads with what to do, in order, and stopping after the first few steps still leaves you most of the protection.
The attack is called ClickFix. How it works.
Start here
I pasted on Windows
I pasted a command into the Run dialog
What to disconnect, why revoking sessions comes before changing any password, and how to see what ran.
Read →I pasted on a Mac
I pasted a command into Terminal
The login keychain, the fake system password prompt, and the same recovery order adapted to a Mac.
Read →I have not pasted anything
Is this CAPTCHA a virus?
How to tell a genuine human-verification check from a ClickFix lure, and what to do with the tab that is still open.
Read →
Not sure whether you pasted? Treat it as though you did — these commands run without a visible window, so there is no telling from the outside.
Nothing on this page asks you to run a command, download a fix, or paste anything into a terminal — and it never will. Any site that offers to solve this for you and then tells you to paste a command is the same attack a second time.