If a Website "CAPTCHA" Tells You to Press Windows + R, Close It Immediately
The FTC says scammers are copying familiar "prove you're human" screens and tricking people into pasting hidden commands into their own computers. If a pop-up asks you to press Windows + R, paste something, or "verify" by running commands, it is not a real CAPTCHA.
A real CAPTCHA might ask you to click pictures, match letters, or check a box. It will not ask you to press keyboard shortcuts, open a Run box, paste a command, or hit Enter. The Federal Trade Commission says scammers are now using fake CAPTCHA screens to get people to install malware on their own devices.
The trick is simple but dangerous. You land on a page that looks routine. Then a box appears saying you need to "verify" yourself by pressing Windows + R, then pasting text, then pressing Enter. That does not prove you are human. It can quietly install malware that steals passwords, email logins, banking details, and other private information.
What to do: If any website tells you to run commands on your computer, close the page immediately. Do not paste anything into the Run box or Terminal. If you already did it, disconnect from the internet, run a security scan, and change important passwords from a different device. This is also a good reminder to keep two-factor authentication turned on for email and banking whenever you can.
The simple rule is this: real CAPTCHAs never ask you to control your computer. If a "security check" wants you to run something, it is the danger, not the protection.
Sources: FTC, "How to spot a CAPTCHA scam"; Google, "Our latest fraud and scams advisory"