You’ve probably clicked “Verify you’re human” hundreds of times without giving it much thought. Usually, it’s a quick checkbox or picture puzzle before you can continue browsing.
But scammers copy these familiar checks to trick people into running harmful commands on their computers.
The warning sign is simple: a verification page asks you to open a tool on your computer, paste something into it, and run it.
This guide explains what to watch for and what to do if you’ve already followed the instructions.
Watch the Video Walkthrough
Prefer to follow along with me? Watch the video below, or continue with the written steps.
Step 1: Recognise the Fake Verification Request
A fake CAPTCHA may initially look like an ordinary security check. It might copy familiar branding and claim that you need to complete a few steps to access the website.
Then it asks you to do something unusual, such as:
- Open the Windows Run box.
- Launch PowerShell, Command Prompt or Terminal.
- Paste text from your clipboard.
- Press Enter to execute it.
Stop at that point. A genuine CAPTCHA does not require you to run a system command to prove you’re human.
This technique is commonly called ClickFix. Instead of installing malware without your involvement, the attacker persuades you to run the command yourself. Some pages copy the command to your clipboard as part of the fake check. Microsoft has documented this technique across malicious and compromised websites.
You don’t need to understand the command to recognise the warning sign.
Step 2: Close the Page Without Running Anything
If a verification page asks you to execute a command:
- Stop following its instructions.
- Don’t paste its clipboard contents into a system tool.
- Close the browser tab.
- Don’t return to try the verification again.
A familiar website address doesn’t make unusual instructions trustworthy. Legitimate websites can be compromised and used to display these fake checks too.
Focus on what the page asks you to do. A padlock or HTTPS connection isn’t a reason to approve a command.
If you didn’t run anything, the recovery steps below don’t automatically apply just because you saw the page. If you downloaded a file, installed something or entered account details, address those actions separately.
Step 3: If You Ran the Command, Check the Device
If you pasted and executed the command, treat the computer as potentially compromised.
- Stop using it to sign into important accounts.
- Disconnect it from Wi-Fi or unplug its network cable.
- Use your security software’s guidance to update it and run a full scan.
- Follow any removal or recovery instructions it provides.
If this happened on a work computer, contact your IT team promptly.
A clean scan alone doesn’t establish that everything is safe. If you know you ran a suspicious command and can’t confirm the device has been cleaned, get help from a trusted technician. Recovery may require reinstalling the operating system.
You can start protecting your accounts from another trusted device while the affected computer is being checked.
Step 4: Review Your Browser Extensions
Review the extensions installed in Chrome or Brave:
- Open the browser’s menu.
- Choose Extensions → Manage extensions, if available.
You can also open the extensions page directly:
- Chrome: type chrome://extensions into the address bar.
- Brave: type brave://extensions into the address bar.
Look for extensions you don’t recognise or don’t remember installing. Check what they are before deciding whether to remove them.
Finding no unfamiliar extensions doesn’t prove the computer is clean. Malware can operate outside the browser.
Step 5: Protect Your Important Accounts
Use a different device you trust for these checks if the affected computer may still be compromised.
For your Google account:
- Go directly to your Google Account.
- Open Security, or Security & sign-in.
- Review Recent security activity.
- Open Your devices → Manage all devices.
- Review unfamiliar activity and sign out sessions you don’t recognise.
- Follow Google’s account recovery guidance if you find suspicious changes.
Google’s recovery guidance includes reviewing security events, signed-in devices and account settings.
Repeat these checks for your other important accounts, starting with your main email and password manager.
Change passwords that may have been exposed, enable two-factor authentication where available, and review recovery email addresses and phone numbers. Sign out unfamiliar sessions as well, changing a password may not end every existing session.
The Rule to Remember
A website does not need you to run a system command to prove you’re human.
If a CAPTCHA asks you to open a system tool and execute something, stop and close the page.
Share that rule with someone who might otherwise follow the instructions. Recognising the request is more useful than trying to judge how convincing the page looks.
