PSA because this keeps showing up on hacked wordpress sites.

if your site gets hit with clickfix, visitors see a box that looks like a captcha. it says press windows + r, then ctrl + v, then enter to "verify". the site has already copied a command to their clipboard, so pasting it installs malware on their computer.

the nasty part is your site doesnt go down. hosting dashboard looks fine, uptime monitor looks fine. you usually find out when a customer complains or google flags you.

quick way to check yours: open it in a private window on desktop and on your phone and look for any verify box you didnt add. check search console under security issues. look through your theme files and recently changed plugins for script tags you dont recognise, and for redirects to domains you dont own.

if you find it, change every password (hosting, wp admins, ftp, database), update everything, delete admin users you dont know, then ask google for a review.

happy to help if anyone finds something weird.