ClickFix: How Hackers Borrow Trust Instead of Stealing It

What if the website wasn't fake — but the message it showed you was? In this episode of SipCyber, Jen Lotze stops into City on a Hill Coffee in Leadville, CO, where the Colorado Rockies rise just outside the window and a hazelnut latte sets the scene for a conversation about one of the most effective cyberattack campaigns in recent memory. 

Cybersecurity researchers uncovered a massive ClickFix malware operation targeting more than 700 education and technology websites — not fake sites, real and trusted ones. Visitors were greeted by a familiar-looking verification screen, asked to prove they were human, and then walked step-by-step into installing malware themselves. No software exploit required. Just trust — and a message that felt routine. 

A side trip to Leadville's straightforwardly named "The Tattoo Shop" becomes an unexpected lens on how trust is built online, how attackers exploit it, and the one question that can protect you: Is this really what it claims to be? 

Key Topics Covered:  

• What the ClickFix malware campaign is and how it spread across 700+ legitimate websites  
• Why real, trusted sites are more dangerous attack surfaces than fake ones  
• How fake CAPTCHA screens trick users into running malicious commands themselves 
•  The psychology of borrowed trust — and why it's so effective  
• One grounding question to ask before you follow any online instruction 

☕ Featured Coffee Shop: City on a Hill Coffee, Leadville, CO 🍵 Jen's Order: Hazelnut latte 

The most dangerous attacks don't feel dangerous. Subscribe for weekly cybersecurity insights from coffee shops across the country — and share this with anyone who's ever clicked "I'm not a robot." 

#Cybersecurity #ClickFix #Malware #SocialEngineering #CyberAwareness #InfoSec #CyberSafety #SipCyber #Phishing #TrustAttacks #DigitalSafety #SecurityTips #CyberEducation 

Transcript

Jen Lotze 0:04

Hey there, coffee lovers and internet explorers. Some places make an impression before you even know why. Leadville, Colorado was like that for me. The mountains seemed impossibly close, rising behind the historic buildings along Main Street. Every direction felt like a postcard. Before heading to my appointment at the tattoo shop, I stopped into City on a Hill Coffee. It was exactly the kind of coffee shop you hope to find in a mountain town. Warm, welcoming, tucked right into the heart of downtown with those incredible Colorado peaks standing guard outside the windows. And as per usual, I ordered a hazelnut latte. It was perfect. Not complicated, not trying too hard, just one of those drinks that makes you slow down and enjoy where you are. As I sat there watching people move along Main Street, I found myself thinking about how we decide what to trust. A little later, I walked over to my appointment at a place called the Tattoo Shop. Very original. I immediately told the owner how much I love the name, the tattoo shop. Simple, direct, memorable. He laughed and told me that the name wasn't some brilliant marketing plan. It just happened. But over time, something unexpected occurred. When people search online for tattoo shop, his business often shows up near the top of the results. Sometimes the simplest thing is exactly what people are looking for. That conversation stuck with me because it says something about trust. People search for something, they find a result, they click. They expect the experience to match what they were promised. Most of the time, that's how the internet works. But recently, cybersecurity researchers uncovered a massive clickfix malware campaign that reminds us that trust online isn't always that simple. More than 700 education and technology websites were compromised. Not fake websites created, real ones, trusted ones. People would visit a legitimate website expecting to find information, resources, or services, but instead a fake verification screen would appear. It looked familiar, professional, normal. The page claimed visitors needed to prove they were human before continuing. You've seen the box before. Many of us have seen those kinds of security checks before, and that's what made it work. But instead of clicking a checkbox, visitors were instructed to copy a command, open the Windows Run box, paste the command, and press enter. The attackers weren't exploiting a software vulnerability on the visitor's computer. They were exploiting trust. The website looked legitimate because it was legitimate. The security message looked familiar because it was designed to imitate something that people see every day. The instructions felt routine. And that's the danger. The scammers weren't asking people to do something that felt risky. They were asking people to do something that felt normal. Sitting in City on a Hill Coffee earlier that day, I was surrounded by things that earned trust naturally, friendly people, a great cup of coffee, a beautiful town, a business that delivered exactly what it promised. Online, attackers often try to skip that process. Instead of earning trust, they borrow it. They hide behind familiar brands, familiar messages, and familiar experiences. And that brings me to one simple step that can make these attacks much harder to pull off. If a website ever asks you to copy and paste a command into Windows Run, PowerShell, Terminal, or Command Prompt to verify your identity, fix an error, or access content, stop immediately, close the page. No legitimate website should require that from an everyday user. For businesses, this is a great reminder to educate employees about clickfix scams before they encounter one. For personal users, the same rule applies. If a website asks you to run commands on your computer, that is a huge red flag. As I left Ladville, I kept thinking about that conversation at the tattoo shop. People search for something. They hope what they find is real. Most of the time it is. The challenge is remembering that trust should come from the experience itself, not from a logo, a familiar screen, or a message telling us to hurry. And maybe that's why my hazelnut latte always sticks with me. Nothing about it asked me to rush. Nothing asked me to prove anything. It was exactly what it appeared to be. And in our digital lives, that's still one of the best questions we can ask. Is this really what it claims to be? Thanks for joining me on this trip to City on a Hill Coffee and for taking a small step to secure digital life. Until then, stay safe, stay human, and keep sipping.