ClickFix shows how a fake “prove you are not a robot” page can steer a user into pasting a command that opens the door for an attacker.
A deceptive CAPTCHA page is being used to push victims into running a PowerShell command that can create a reverse tunnel back into internal systems.
Paste Protect is built into the browser, enabled by default on Windows, macOS, and Linux, and aimed at cutting off clipboard hijacking and ClickFix-style code injection before a user can paste trouble into place.