A "security verification" CAPTCHA tells you to press keyboard shortcuts — then installs malware
A fake Cloudflare or browser-check CAPTCHA on a hacked Australian website instructs you to press Windows+R, Ctrl+V, then Enter — secretly running malware already placed on your clipboard. It steals bank passwords, cryptocurrency wallet keys, and browser-saved credentials. ASD/ACSC issued a specific warning for Australia in May 2026.
Also known as: ClickFix scam Australia, fake Cloudflare CAPTCHA malware, keyboard shortcut virus AU, PowerShell clipboard attack, Vidar Stealer Australia, Lumma Stealer Australia, gaming site fake CAPTCHA malware
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 If you have not yet pressed the keys: close the browser tab immediately — do not complete the CAPTCHA instructions
- 2 If you already pressed Enter: disconnect from the internet immediately, then run a full antivirus or anti-malware scan before reconnecting
- 3 Change all passwords — for banking, super, myGov, email, and crypto accounts — from a separate, clean device
- 4 If you hold cryptocurrency, move funds to a new wallet immediately; recovery phrases stored on the infected device may already be stolen
- 5 Contact your bank if you notice any unauthorised transactions
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ Any CAPTCHA or 'security check' that tells you to press Windows+R, Ctrl+V, and Enter — legitimate CAPTCHAs never ask you to run commands
- ⚠ The page may show a Cloudflare logo, a Microsoft logo, or a spinning 'verifying your browser' animation to appear legitimate
- ⚠ A brief black command window flashes and closes after you follow the steps — that is the malware (Vidar Stealer) running silently
- ⚠ On Mac: a page tells you to open Terminal and paste a command to prove you are human
- ⚠ You did not consciously download any file, yet something may have run in the background
- ⚠ The compromised page is often a real, legitimate Australian business website — so the domain looks safe
Sources
- ASD ACSC — ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure (May 2026)
- SBS News — 'Now measured in the millions': The common process being used to scam Australians
- Bitdefender — ClickFix Campaign Uses Compromised WordPress Sites to Spread Vidar Stealer in Australia
- Cyber Daily AU — ACSC warns of ClickFix campaign leveraging Australian infrastructure
- CERT NZ — Social engineering scam ClickFix using websites to spread malware (September 2026)
- McAfee — Multi-country ClickFix campaign targeting gaming sites with Lumma Stealer (October 2026)