Some cyber scams don't start with an obvious threat. It can begin with a prompt that seems routine:

• “Verify that you are human.”
• “Your browser needs an update.”
• “This document cannot be opened.”

The page then provides simple, step-by-step instructions to solve it: open Windows Run, PowerShell, or Terminal, paste a command, and press Enter. The instructions may look helpful, but they are a warning sign.

What is "ClickFix"

This tactic is known as ClickFix. Attackers use fake troubleshooting steps to persuade you to run a command yourself. That command may install malware, steal information, or give someone access to your computer.

Sometimes a button on the page copies the command automatically, so what you paste may not be what you think you copied.

ClickFix instructions can appear on a website, in an email or attachment, during a fake CAPTCHA, or in a message from someone claiming to provide technical support.

How to Tell What's Legitimate

A real CAPTCHA may ask you to check a box or select images. It should not ask you to open another program or paste a command. Software updates should come through the application, your device settings, an official app store, or another trusted UMBC source, not instructions copied from a pop-up.

What to Do If You See ClickFix Instructions

1. Stop: Do not paste or run the command.

2. Close the page: If the instructions arrived by email, forward the message to security@umbc.edu or select “Report phishing” in Gmail.

3. Report: If you already followed the instructions, stop and contact security@umbc.edu. Tell the security team what you were asked to do and what you entered so they can help.
4. Verify Updates: If an update may actually be needed, check through the application or your device settings

You do not have to understand the command to recognize the warning sign. If a website or message asks you to paste something into Windows Run, PowerShell, or Terminal, treat the request as suspicious.

Celebrate Cybersecurity Awareness Month with Us

Share This Information

Forward this email to a friend and encourage them to follow us at IT Security - DoIT Cybersecurity Assurance and Digital Trust on myumbc. Learn about recent cybersecurity attacks and articles about threats, scams, and attacks. 

Join Us

Want to see whether your email address has appeared in a known data breach? Visit us in the Commons Breezeway during the following event. We can help you check, answer questions, and decide what to do next.

• 10/28/26 from 12 pm - 1 pm: Celebrate Cybersecurity Awareness Month (Commons Breezeway)

The first draft of the above announcement was generated using AI and edited by the Division of Information Technology Communications and IT teams.