What an ordinary CAPTCHA is for
A CAPTCHA is a challenge meant to distinguish a human visitor from an automated program. Legitimate CAPTCHA designs vary considerably: some ask you to select images matching a description, some display distorted text to type back, some offer an audio alternative, and some — reCAPTCHA’s widely used checkbox version, for instance — simply ask you to check a box, relying on background signals rather than a visible puzzle at all. Because this variety is real, “completed entirely with mouse clicks” is not a universal definition of a legitimate CAPTCHA — an audio CAPTCHA involves listening and typing, for instance. What every legitimate variant shares is narrower and more useful as a test: the interaction stays inside the webpage itself and does not require you to open a separate system tool.
What the fake CAPTCHA (ClickFix) pattern actually is
The FTC issued a consumer alert in June 2026 describing a phishing pattern that closely imitates a CAPTCHA request. In the FTC example, the screen looks like a familiar human-verification check but instructs the reader to press “Windows key + R,” then “Ctrl + V,” then “Enter.” CISA describes the broader malicious copy-and-paste strategy as ClickFix: the user is persuaded to execute content presented as a helpful fix or CAPTCHA step. The FTC explains that its example pastes and runs hidden malware despite being presented as “security verification.”
How the instructions unfold
The specific wording varies, but the underlying sequence tends to follow the same shape: the page asks you to open a system tool — the Windows Run dialog, PowerShell, a Terminal window, or an equivalent on another operating system — and then paste something that the page has already copied to your clipboard, followed by pressing Enter to run it. This is worth breaking into its actual separate steps, because they carry different levels of risk:
- Copying — content is placed on your clipboard, either automatically by the page or by a button you click. Copying alone does not run anything.
- Pasting — you paste that content into a system tool. Pasted text sitting in a Run dialog or terminal has still not executed.
- Executing — you press Enter, or otherwise trigger the pasted content to run. This is the step that actually carries out whatever the command does.
Distinguishing these matters directly for figuring out what, if anything, actually happened to your device — copying and pasting without pressing Enter is a meaningfully different situation from having executed the command.
Why leaving the browser is the central warning sign
The central warning sign in this pattern is the instruction itself: the FTC states that real CAPTCHAs will not ask you to run commands on your device. Proving that you are human does not require an unexplained command in Run, PowerShell, or Terminal. Whatever else the page looks like, pause when it moves verification into a system command interface.
Why familiar branding and polished design do not establish legitimacy
A fake CAPTCHA page can be visually convincing, since copying a familiar design, color scheme, or even a specific CAPTCHA provider’s branding requires no special skill. Visual polish says nothing about whether the underlying instructions are legitimate — the same is true of the page’s domain, which is worth reading using the method in How to Read a URL: Every Part Explained in Plain English rather than judged by appearance. The same applies to the domain hosting the page using HTTPS — an encrypted connection confirms the connection itself is private; it does not confirm that whoever built the page has honest intentions, since certificates are available to any domain regardless of purpose.
How this pattern gets disguised
Beyond a straightforward “verify you are human” framing, the same instruction may be placed inside an alarming browser-error or support warning like those explained in How to Recognize a Fake Tech-Support Warning. It may instead claim that a document needs a special step to open, or present an “update required” story resembling the prompts in How to Handle Suspicious Download and Update Pop-Ups. The cover story can change; the useful warning sign is an instruction to leave the browser and execute unexplained content that you did not write or independently obtain from a trusted source.
Platform scope, stated carefully
The FTC example uses Windows key combinations and the Run dialog. That does not mean each fake CAPTCHA uses an identical command, or that the underlying social-engineering pattern is exclusive to Windows. A page could adapt its instructions to another tool or operating system. Treat the instruction to leave the browser and run unexplained content as the relevant detail rather than memorizing one command sequence. This pattern is a close relative of the alarming full-screen warnings covered in How to Recognize a Fake Tech-Support Warning, which use similar borrowed visual language.
Seeing the page is not the same as being infected
Loading a page that displays this kind of fake CAPTCHA does not, by itself, show that its instructed command ran. Closing the tab without following the instructions leaves you in the lowest-risk category covered by this guide. What happened afterward — nothing, copying, pasting, executing, downloading, opening, installing, or submitting information — determines the appropriate response.
Recovery: the page was viewed but no instructions were followed
If the page merely displayed and you did not download or open a file, run a command, grant a permission, or submit information, close the tab. This scenario alone does not establish device compromise and does not call for disconnecting the device or resetting it.
Recovery: text was copied but not pasted
Clearing your clipboard is a reasonable precaution, though clearing the clipboard is not malware removal — it simply prevents the copied command from being pasted by accident later. If nothing else was downloaded, opened, installed, permitted, or submitted, copying alone does not execute the text.
Recovery: a command was pasted but not executed
If you pasted the content into a system tool but did not press Enter or otherwise trigger it, closing that tool without running anything means the command was not executed. Close the tool, clear the clipboard, and treat this the same as the “no instructions followed” scenario.
Recovery: a command was executed
- If an unknown command ran and active compromise is plausible, disconnect the device from the network while you assess it; this step is not required after merely viewing the page.
- Run a full scan with updated, reputable security software.
- Follow the scan’s removal recommendations for anything it finds.
- If the command may have exposed account data, change passwords for sensitive accounts from a separate, trusted device and enable two-factor authentication where available.
A security scan is a genuinely useful step here, but running one does not guarantee the device is completely clean, since no scanner detects every possible threat; this is why remaining alert for continued unusual behavior afterward is still worthwhile.
Recovery: a file was downloaded
A downloaded file that has not been opened has not been executed. Delete it without opening it. This scam sometimes overlaps with the fake update and download prompts covered in How to Handle Suspicious Download and Update Pop-Ups; if you are not certain whether the file was opened, treat the situation as the next scenario instead.
Recovery: a downloaded file was opened or installed
Opening a file is not identical to completing an installation, but it may allow code to run. Treat an opened or installed file like an executed unknown command: consider conditional network isolation, use updated security software, follow its removal guidance, and seek qualified help if you cannot determine what ran. Change passwords from a trusted device when credential theft is plausible rather than treating password changes as an automatic consequence of every opened file.
Recovery: credentials or sensitive information were entered
Change the exposed password immediately, on the real site reached independently rather than through anything related to the scam page. If that same password was used on another account, change it there too — updating one account does not protect a different account that reused the same exposed secret. Review active sessions and recent account activity where the provider offers those controls.
Recovery: the incident occurred on a workplace-managed device
Contact your employer’s established IT or security channel promptly rather than attempting to resolve a managed device entirely on your own. Follow that team’s incident instructions, because it can check organization-specific logs, controls, and affected accounts that a general consumer guide cannot see.
When to disconnect from the network, stated conditionally
Disconnecting from the internet is a precaution specifically relevant when a command has actually been executed or a file has been run — it is not something merely viewing a suspicious page requires. Treat this step as tied to actual execution, not as a blanket response to encountering the page at all.
What this guide does not claim
A factory reset is a significant, disruptive step that this scenario does not automatically require — it becomes more relevant if a device continues behaving unexpectedly after the steps above, or if you cannot otherwise be confident it is clean. If you cannot determine what actually executed, or remain uncertain after taking the steps above, a qualified independent technician can help assess the device more thoroughly than these general steps allow.
A hypothetical example, worked through
The following is a hypothetical scenario, not a documented real incident. A page displays a box reading “Verify you are human,” followed by instructions to press a specific key combination, paste, and press Enter. Applying the pattern above: a real CAPTCHA does not require leaving the browser, regardless of how the page is styled or which familiar logo it displays. The safe response is closing the tab without following the instructions — and if any of the steps were already followed, working through the corresponding recovery section above based on exactly how far the sequence went.
Frequently asked questions
Does every executed command in this pattern install malware?
The specific effect depends on the exact command used, which varies by version of this scam — this guide does not assume a single universal outcome. Treating any executed, unexplained command from this pattern as a reason to run a security scan is the safer default regardless of the specific payload.
Can security software catch this automatically?
A browser, operating system, or security product may warn about some harmful content, but no warning system guarantees detection of every command or resulting change. If an unexplained command ran, use updated security software and follow its findings while recognizing that a clean scan is evidence, not a guarantee.
How do I report a page like this?
In the United States, the FTC’s guidance directs you to report it at ReportFraud.ftc.gov.
1 Comment