The attack is basically getting someone to accidentally run malicious code.

- ctrl + R brings up the Windows "run" dialogue.

- the code executes a powershell command that reaches out to a remote server

- if successful, the remote server answers and you have installed a dropper or something.

Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.

https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...

You saw something unusual, then

1. Stopped what you were doing.

2. Investigated to see if this was legitimate or malicious.

3. Identified a place to asked others about it.

4. Formulated a good question with enough background information to help people answer it.

All around good job! Well done.

Endless vigilance. Scammers are always working on new tricks. You were rightly suspicious and not fooled by this one.

Was the site itself actually infected(hacked)? If not, then all you need is adblock (like ublock origin). And that was true for last 20 years.

If website actually got hacked then I don't know of any good solutions. It will be flagged soon or later, and new visitors will be blocked by "Google Safe Browsing". Using something like "Qubes OS" might protect you against attacks based on browser zero-days but VMs don't really protect against ClickFix when people usually share clipboard between host and client VMs.

I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.