A customer who works from a flat off Dundee Street in Dalry dropped a Windows laptop on the bench a few weeks back. The story was unremarkable — she had searched for a football stream on a Sunday afternoon, landed on a site she had never seen before, and been met with what looked like a routine “I am not a robot” verification. The page asked her to press the Windows key with R, then Ctrl with V, then Enter — three ordinary-looking keystrokes to “prove she was human”. A small black window flashed up and vanished. The stream played for a minute, then froze. By Tuesday her bank had rung her about a login from an IP in Amsterdam, and the saved passwords in her browser were being used to log into email accounts she had not touched in years.
This is the pattern we see most on the Dalry Gorgie workshop bench now — the fake CAPTCHA, often called the “ClickFix” attack by security researchers. It is the current favourite trick of the people behind the family of malware called infostealers, and it is specifically written for Windows PCs. The notes below are what the attack actually does, how to recognise the page before the paste, and the sequence we run through on the bench when the paste has already landed.
What the Three Keystrokes Actually Do
The fake CAPTCHA page uses a tiny piece of JavaScript to copy a line of malicious code onto your clipboard the moment the page loads. You do not see this happen — the clipboard is replaced silently. The instructions on screen then walk you through pasting that invisible payload into the one place in Windows that will run it without a security prompt. Windows key with R opens the Run dialog, Ctrl with V pastes whatever is on the clipboard into that box, and Enter executes it. The payload is almost always a short PowerShell command that reaches out to a remote server, downloads the real malware, and runs it in the background. The black window that flashes up is the PowerShell host doing exactly that, and it is deliberately styled to disappear before you can read it.
What makes the attack effective is not the technical cleverness — it is the social framing. The page looks exactly like a verification challenge people are trained to click through dozens of times a day. The three keys are familiar; nothing on screen looks like an installer. There is no User Account Control prompt because PowerShell runs in your user context, and nothing is downloaded through the browser, so the browser’s own download warnings never fire.
Why This Attack Only Works on Windows PCs
The Run dialog and PowerShell are Windows-only, which is why Mac and Chromebook users who hit the same page just see nonsense instructions. On a Windows machine the three-keystroke sequence works whether you are a home user on Windows 11, a small business on Windows 10 still inside Microsoft’s Extended Security Updates year, or a gaming PC on a brand-new install. It also works regardless of which browser you use, because the payload runs outside the browser entirely. Antivirus can catch the downloaded malware if the signature is already known, but a freshly rotated payload will often slip through for a day or two before the pattern is added to detection lists.
If the page you landed on was a convincing fake of a Windows system warning rather than a CAPTCHA, that is a related but distinct trick — our note on the Chrome browser hijacker covers that family, and our wider walk-through of tech support scams in Edinburgh covers the pop-ups that ask you to phone a number instead of pressing keys.
The Warning Signs on the Page
A genuine CAPTCHA never asks you to press keys outside the browser. If a verification page tells you to open Run, open PowerShell, open the Terminal, or paste anything into a Windows dialog, the page is hostile. The second tell is the content of the page before the challenge — sites that run real Cloudflare or Google verification tend to be ones you recognise, whereas the fake CAPTCHA almost always appears on pages you landed on by accident: a search result for a live sports stream, a download mirror for software, a cracked key generator, or a video embedded on a social media post. The third tell is the instruction style — a line that reads “Press Windows + R, then Ctrl + V, then Enter” is never part of a legitimate verification.
If a page asks for those keys, close the tab, do not paste anything, and clear your clipboard by copying a harmless word from anywhere else before you continue. The payload sitting on your clipboard is only dangerous once it is pasted into Run, PowerShell, or the Terminal — pasting over it with any other text neutralises it.
If You Already Pressed Enter
Assume the machine is compromised and the clock is ticking. The first hour matters more than the next week. Our usual sequence on the bench, which also works at home if you are confident:
- Disconnect from the internet. Pull the Ethernet cable or turn Wi-Fi off from the keyboard with the function key. This stops the malware exfiltrating anything else while you work.
- Do not shut down normally. A clean shutdown gives the malware a chance to finish writing persistence into the registry and scheduled tasks. Hold the power button if you must power it off, but ideally leave it on and work from a second device.
- From a different, trusted device, start changing passwords on the accounts the browser had saved. Email first, then banking, then everything the saved logins touched. Turn on two-factor authentication wherever it is not already on.
- Sign everything out everywhere. Most major services have a “sign out of all sessions” option in account security. Use it. This invalidates the session cookies the malware is likely to have stolen, which matters more than the password change on its own.
- Phone your bank if saved card details, online banking logins or a password manager were in the browser. The fraud team can watch the account for the next few days.
- Bring the machine in rather than running a scan and trusting the all-clear. The malware this attack installs is usually a fast infostealer that has finished its job within minutes; what we remove is the second-stage loader it leaves behind so the same people can come back later.
What the Malware Usually Steals
The infostealer families that ride this attack — the ones under names like Lumma, RedLine, Vidar and StealC — are all built around the same job. They sweep every browser profile on the machine for saved passwords, auto-fill data, saved card numbers and session cookies. They look for cryptocurrency wallet files and desktop wallet apps, the Discord, Telegram and Steam token files that keep you logged in, and any password manager vaults that were left unlocked. They parcel it all up into a small archive, upload it to a server the attacker controls, and in many variants delete themselves to make the aftermath harder to analyse.
The session cookie theft is the quiet part that catches people out. A rotated password closes the door for the next login, but the cookie the attacker already has keeps them signed in to the previous session until the service invalidates it or you force a sign-out everywhere. That is why the “sign out of all sessions” step above is non-negotiable, and why a password manager that was unlocked at the moment of compromise is treated at the bench as a full master-password rotation job. Our longer piece on the right way to set up a password manager covers how to rebuild that safely afterwards.
Why a Clean Reinstall Is Often the Honest Answer
A sensible antivirus can usually find and quarantine the first-stage payload after the fact. What we trust less is that it has caught every piece of the second stage — the scheduled task that silently reinstalls the loader at next login, the registry run-key that triggers it from a renamed binary in AppData, the browser extension that was side-loaded while nobody was looking. On a machine that holds anything that matters — email, banking, work files — we usually recommend a clean reinstall of Windows after the data is pulled off safely. It is quicker than hunting the last hidden piece for days, and it leaves you with a machine you can trust again. The clean install itself and the drivers afterwards sit under our OS installation service, and the deeper scan-and-removal pass before we decide one way or the other is covered under virus and malware removal.
If the machine was a work laptop and there is any chance company data was on it, the right call is to tell the IT contact at your employer the same day — a stolen session cookie for a work email account is treated as a breach even if nothing visible has happened yet.
What to Reset After the Machine Is Clean
Cleaning the laptop is only the first half of the job. The second half, which is the part most people underestimate, is tidying up every account the browser had ever remembered. Work through the saved-login list in the browser profile and change the password on every one that still matters, starting with the email account you use to reset other passwords. Turn on two-factor authentication wherever it is offered, and prefer an authenticator app over SMS. Review the recent-activity log on your email and your bank for the previous week and flag anything you do not recognise. Revoke any third-party apps you do not recognise under “connected apps” or “account access” in Google, Microsoft and Apple ID. If you use a password manager, change the master password and the recovery details from a device you know is clean.
None of that undoes a theft that has already happened, but it closes the doors that would otherwise stay open for weeks after the laptop is back on the shelf. Expect a short wave of phishing emails to your contacts in the days afterwards, where the attacker uses the stolen address book to send more of the same links in your name — a short heads-up to anyone who matters saves the worst of it.
The Bench Cleanup We Do in Dalry Gorgie
When a Dalry, Gorgie, Fountainbridge or Haymarket customer brings a machine in after one of these pastes, the sequence on the bench is the same every time. The drive comes out and goes into a write-blocking adapter so we can image the user profile and look through the browser caches, the AppData folders and the scheduled tasks without the malware getting another chance to run. We identify which infostealer family hit the machine from the artefacts it left behind, confirm what categories of data were in scope at the time, and give you a short written list of the accounts you should treat as touched. If the loader has already pulled a second-stage payload we clean that too; if the machine is going back to a user for anything important we usually recommend the clean reinstall. The Dalry Gorgie virus removal page has the specifics on turnaround and collection, and the broader bench work — the follow-up account tidy-up, the Windows reinstall and the browser rebuild — sits under software troubleshooting while we have the machine open.
Collection runs cover Dalry, Gorgie, Fountainbridge, Haymarket, Tollcross and the Sighthill side of Edinburgh on the regular west-city route, and the EH11 workshop is a short walk from Gorgie Road. If you have pasted the three keystrokes already, book a bench appointment or drop us a message and we will tell you what the first hour should look like before we even see the machine.
Last updated: 29 October 2026