A page says the document cannot open until the visitor proves they are human. The next instruction is to open a system utility and paste a command. The verification story is the distraction; the requested action is the warning sign.
This is a useful training example because employees do not need to analyze a command to recognize that the workflow is wrong.
Teach the boundary crossing
HHS's ClickFix alert describes social engineering that persuades users to carry out malicious instructions while supposedly fixing a problem or completing verification.
For workplace awareness, focus on the unexpected transition: a website asks the person to perform an operating-system action unrelated to the task. Do not teach employees to decide whether the pasted content looks technically safe.
A familiar logo, document preview, or convincing progress message does not make the instruction authorized.
Provide a response that takes seconds
Tell users to stop, leave the page, and report the address and approximate time through the normal security channel. They should not run the instruction again to create a better screenshot.
If a person already followed the steps, they should say so immediately. A clear, non-punitive reporting path is more valuable than asking them to investigate the payload themselves.
Do not include executable examples in general-awareness material. The behavioral pattern can be explained without circulating a working command.
Give the help desk a separate script
The first responder should establish what the person clicked, whether anything was pasted or executed, which device was involved, and whether work accounts were used afterward.
Route suspected execution to the endpoint response team. An account-password reset may be part of the eventual response, but it does not inspect or restore the device.
Preserve relevant evidence through approved tooling. Avoid telling the employee to search for files, remove programs, or repeatedly revisit the page unless the authorized response team directs it.
Practice with a harmless scenario
Use a static, non-executable training example clearly marked as an exercise. Ask the team to identify the moment the page crosses from a web interaction into a system action.
Then test the organizational handoff: who receives the report, who can help the user continue their legitimate task, and who decides when the device is ready for work?
Do not label every failed document preview a malware incident. The point is to recognize suspicious instructions and investigate their consequences accurately.
Read download verification beyond the first search result and credential resets after endpoint review. Good awareness training gives people a recognizable boundary and an immediate next step.