ClickFix Fake CAPTCHAs: The Infection Kit on Hacked Small Business Sites
A visitor opens a small business website and sees what looks like a Cloudflare or reCAPTCHA check: “Verify you are human”. The steps that follow are unusual: press the Windows key and R, press Ctrl+V, press Enter. Behind the scenes the page has already copied a system command to the clipboard. Following the steps runs it, and the visitor’s computer downloads malware, typically a password and session stealer.
This technique is called ClickFix. In 2025 and 2026 it became the most common payload on hacked WordPress and other small business sites; security researchers counted thousands of infected sites in single campaigns. The site owner usually notices nothing, because the box often appears only for first-time visitors on Windows who arrive from a search engine.
How the kit gets onto a site
Attackers break in through an outdated plugin or theme, a weak or reused admin password or a compromised hosting account. They then add a small loader script to every page, often in the theme files, a “custom code” plugin or a database option that the theme prints.
Many loaders don’t contain the payload at all. They ask a blockchain node for the next stage, which is stored in a smart contract (a technique called EtherHiding). The attacker can change the payload at any time and nobody can take it down, so cleaning the loader from the site is the only fix.
What we check
- Fake CAPTCHA instructions in the page: Win+R together with Ctrl+V and verification wording.
- Clipboard commands: an inline script that writes a system shell command to the clipboard.
- Blockchain calls on a non-crypto site: an inline script or a loaded resource that talks to a public blockchain node. Sites that are about wallets, tokens or crypto are skipped.
| Result | When |
|---|---|
| Pass | no instructions, clipboard commands or blockchain calls |
| Fail | one of them was found (a strong sign of an infection) |
We read the page as it was served to us. A kit that only shows to some visitors may not appear in one scan; a monitor that re-scans regularly gives it more chances to show.
How to remove it
- Find the loader. Search theme files, must-use plugins and “header/footer code” settings for
unknown script tags, especially ones that decode text or contact blockchain nodes. Check the
database options table for recently added entries that contain
<script. - Remove it and the way in. Delete the code, update WordPress, every plugin and the theme, remove what you don’t use and change all passwords (admin users, hosting, database, FTP/SFTP).
- Look for persistence. Attackers often add a hidden admin user, a scheduled task or a second copy of the loader. Compare core files with clean copies and list recently modified files.
- Warn affected visitors if you have a way to reach them, and request a review in Search Console if Google flagged the site.