Fake CAPTCHA scams: why a website asks you to press Windows + R
A fake human check can turn a routine click into a command on your PC. Learn the warning signs and what to do if you saw, copied or ran one.
10 min read
- Author
-
-
- Published
- Reading time
- 10 min
You click through to a game guide, a download page or an article. Before you can continue, a familiar-looking box asks you to prove you’re human. So far, so ordinary.
Then it tells you to press Windows + R, paste something and press Enter.
Stop there. A genuine CAPTCHA does not need you to run a command on your computer. The US Federal Trade Commission describes that exact keyboard sequence in its warning about fake CAPTCHA scams . The page is trying to turn a routine verification into an instruction your PC will execute.
This trick is commonly called ClickFix. You do not need to learn PowerShell to recognise it. The useful question is simpler: why is a website asking you to leave the browser and run something?
If you already ran the command, disconnect that PC from the internet. Use a different, trusted device to get help and secure your accounts. The response guide below separates that situation from merely seeing the page or copying text.
What is a ClickFix scam?
ClickFix is a social engineering technique: an attacker persuades you to carry out a harmful action by presenting it as a helpful or necessary step. The story might be “verify you’re human”, “repair this page” or “fix a browser error”.
ClickFix describes the trick used to deliver an attack. Different campaigns can install different malware. Microsoft’s analysis of ClickFix documents campaigns that delivered information-stealing malware, remote access tools and other malicious software.
That distinction explains why there is no single “ClickFix removal” button. What needs cleaning up depends on what actually ran. Recognising the request before execution is much easier than working that out afterwards.
What those three keyboard instructions actually do
The fake check relies on making ordinary Windows actions feel like part of a website.
*Conceptual flow, not a screenshot: the dangerous hand-off is from a page’s instructions to code running on your computer.*
Here is the familiar Run-box version, broken down for recognition. These are warning signs to recognise, not steps to try.
- Press Windows + R: Opens Windows’ Run box, which can launch programs and commands.
- Press Ctrl + V: Pastes whatever is currently on the clipboard into that box.
- Press Enter: Submits the pasted instruction for Windows to run.
Singapore’s Cyber Security Agency describes this copy, paste and execute sequence in its ClickFix advisory. The keyboard shortcuts are ordinary tools; the problem is whose instruction you are giving them.
You might never have deliberately copied a command. In a TerminalFix campaign documented by Microsoft in August 2026 , interacting with the fake verification copied one to the clipboard. The page then directed people to Windows Terminal or PowerShell.
So do not make “it didn’t mention Windows + R” your test of legitimacy. The destination can change. A supposed human check that asks you to open Run, PowerShell or a terminal and paste instructions has crossed the same boundary.
Why a convincing page can still be dangerous
Imagine you are trying to get a game mod working. You have already clicked through two pages, and the next one promises the file you need. A verification screen feels like one more obstacle to clear.
The request deserves a pause: your goal is getting to the download, while the page has quietly introduced a different task.
You do not need to decide whether its logo is copied perfectly. You need to decide whether the requested action makes sense.
A familiar website address is not enough either. The Swiss National Cyber Security Centre’s August 2026 alert describes legitimate websites that had been compromised to display fake checks. It also reports versions tailored to Windows and macOS. Visiting a site before without trouble does not make a new command prompt trustworthy.
For a useful comparison, Cloudflare’s real Turnstile system performs checks in the browser. Depending on its mode, it can show a checkbox or require no interaction. A logo claiming to be Cloudflare does not turn a terminal command into part of that process.
Judge the requested action
- A checkbox, an image puzzle or a browser check: Consistent with ordinary verification, but appearance alone does not prove the page is trustworthy.
- Instructions to open Run, Terminal or PowerShell and paste a command: Stop. This is a ClickFix warning sign.
- A “verification” that asks you to install software or disable security protection: Leave the page. Do not make that change to get past the check.
- A CAPTCHA asking for your account password or other sensitive details: Treat it as a credential-stealing attempt; do not enter them.
New Zealand’s Own Your Online ClickFix alert makes the distinction clear: legitimate verification does not require those command-running steps or account credentials. Keyboard navigation itself is fine; the warning is being asked to execute something on your device.
What to do now: match the response to what happened
The important detail is how far you went. Seeing a suspicious page, copying text and executing a command are different events.
*Use the response that matches your actions. If you both ran a command and entered a password, address the device and the account.*
You only saw the page
Close the tab without following its instructions. If it appeared after a message or a download link, do not return through that same route to “check again”.
In the ClickFix sequence described here, the command-execution step has not happened merely because the prompt appeared. Seeing it is not, by itself, proof that your PC is infected. Any separate security alert or unexpected download still deserves attention.
If you need the underlying service, open it through a bookmark or an address you already know. Find downloads through the developer’s official website or the platform’s own store.
You clicked the check or copied text, but did not paste it into a command window
Close the page and avoid pasting the clipboard into Run, PowerShell or Terminal. Copying a command is not the same as executing it.
On a personal Windows 11 PC, you can remove the clipboard contents through Settings → System → Clipboard → Clear clipboard data → Clear. Microsoft’s clipboard instructions note that pinned history items are excluded; remove a suspicious pinned entry individually if you saved one.
Do not paste the suspicious text into a command window to find out what it does. Clearing the clipboard helps prevent a later accidental paste. It does not remove malware if you already ran the instruction.
You pasted into Run but cancelled before submitting it
If you are certain the text only reached the Run box and you neither pressed Enter nor selected OK, cancel the dialog, close the page and clear the clipboard.
Do not apply that reassurance to a terminal. Microsoft explains that pasting text containing newlines into a shell can execute commands automatically . You cannot rely on “I never pressed Enter” after pasting into PowerShell or Terminal.
If you pasted there, or cannot confidently remember what happened, use the next response.
You ran the command, or are unsure whether it executed
Treat the PC as potentially compromised, even if it still seems normal.
- Disconnect the affected device. Turn off its Wi-Fi or unplug its Ethernet cable. This cuts that device’s network connection; it does not undo anything already stolen.
- Stop using it for sensitive activity. Use a different, trusted device for account recovery and contacting support.
- If it is a work or school device, contact IT immediately. Explain what you clicked, what you pasted, when it happened and whether anything opened. Follow their incident process before scanning, restarting or resetting it.
- For a personal PC, get help from a trusted technician if you are unsure how to assess it. Use your installed security software or the official Windows tools below. Ignore any “cleanup” download or support number supplied by the suspicious page.
The FTC’s response advice supports disconnecting, scanning and changing passwords from another device. Microsoft separately advises contacting IT after a suspected phishing incident on a work computer .
A brief window that vanished does not tell you whether the command failed. Neither does the absence of a conventional installer: ClickFix can start malware through commands, as Microsoft’s attack analysis explains.
Checking a personal Windows 11 PC
For a PC using Microsoft Defender Antivirus, open Windows Security → Virus & threat protection → Scan options.
Microsoft documents two relevant choices:
- Full scan checks the files and programs on the device.
- Microsoft Defender Antivirus (offline scan) restarts the PC and performs a quick scan in the Windows Recovery Environment, outside the normal running Windows session.
Save open work before the offline scan. Afterwards, check Protection history and follow the security app’s recommended actions. These steps come from Microsoft’s Windows Security guidance . Options can differ if another antivirus product manages protection.
A scan with no detections is useful information, but it cannot establish that no credentials were taken. Keep the affected device disconnected while arranging help if you cannot establish what ran; use another device to read recovery guidance.
For confirmed or persistent infection, a clean reinstall or reset may be necessary. Get advice before doing it: resetting can remove data, and you need to preserve important personal files without restoring the malicious download. Own Your Online’s malware-removal guide explains the scanning and reset options.
Secure accounts separately from the computer
If you entered a password into the fake check, secure that account even if you never ran a command. If malware executed, also consider credentials that were accessible on the affected PC: the Swiss NCSC describes infostealers taking login details and other sensitive data from infected computers .
From a different, trusted device:
- Change exposed passwords and any reused passwords on other accounts.
- Use the provider’s controls to sign out other sessions or devices.
- Review recent sign-ins, recovery details and, for email, unfamiliar forwarding rules.
- Enable two-factor authentication where available.
- If financial details or transactions are involved, contact your bank through its official app, website or a known number.
These actions follow the UK NCSC’s account-recovery guidance . If you are locked out, use the provider’s official recovery process.
Cleaning the PC and recovering accounts solve different problems. Removing malware cannot take back information already copied, while changing a password does not remove software still running on the device.
The rule to remember next time
Keep Windows, your browser and your security software updated; CSA recommends those measures alongside recognising ClickFix prompts . They are useful layers of protection.
At the moment of the prompt, though, you have a much simpler decision to make.
If proving you’re human means opening a command window and running something, close the page. You do not need to finish the check, decode the command or find out whether the warning was real.
Sources and further reading
Guidance checked on 22 October 2026. This article explains documented scam patterns and first-response steps; an individual device may need professional assessment.
