Windows ClickFix: fake 'Windows Security' verification dialog (Win+R, mshta) — page code

Compromised websites whose homepage is replaced, for Windows visitors only, by a fake reCAPTCHA-style checkbox that opens a 'Windows Security — Human verification required' dialog. The dialog copies a command to the clipboard and tells the visitor to press Windows key + R, paste with Ctrl+V and press Enter. The command uses mshta to download an executable from a file-sharing link, save it as %TEMP%\verification.exe and run it; the payload has been reported as an information stealer. Closing the dialog only makes it reappear. Visitors on macOS or a phone see the normal website, so site owners rarely notice. Seen on 2026-10-01 on unrelated WordPress sites at three hosting providers, all serving the same page. No legitimate verification step asks visitors to run a command.