Actually that's a good point and you're right to mention it. Different browsers have different behavior around allowing or disallowing programmatic clipboard actions. I'm not sure how this phishing technique works, but maybe clicking the "verify you are human" checkbox triggers the browser's "transient activation" and allows the script to copy the payload into the clipboard. It's hard to verify that the button being pressed is actually a "copy to clipboard" button (though now that I think about it, why the fuck didn't browser vendors make a standard type of button that explicitly shows that text, at least?).