A "verify you're human" box should never ask you to press Windows + R

Here is a verification box that asks you to carry out the attack on its behalf. You click a link, a familiar-looking panel appears, and it says "Verify you are human." You have clicked a hundred of these. But this one doesn't want you picking out traffic lights. It wants you to press Windows + R, then Ctrl + V, then Enter. That is not a verification step. That is the whole attack, and it is politely asking you to run it yourself.

What's actually going on?

In June 2026 the FTC's Bureau of Consumer Protection published a consumer alert, "How to spot a CAPTCHA scam" (BCP Staff, June 8, 2026), saying it was getting reports about a phishing scam built to look a lot like the CAPTCHA requests people are used to seeing. The fake version, the FTC wrote, tells you to type a series of commands, something like Windows + R, then Ctrl + V, then Enter. The screen may describe this as a security verification. What you are actually doing is pasting and running hidden malware.

Here is what those three keystrokes do, in plain language:

Nothing on your screen shows you what was pasted. The Run box is narrow, the command is padded with spaces and decoy text, and it disappears the moment you press Enter. Security researchers call this pattern ClickFix, because the page usually frames the copy-paste step as a fix: your browser needs an update, the document failed to load, the video needs a codec, please complete verification.

Tell #1: the instruction itself

This is the rare scam with a clean, bright line through it. You don't have to judge whether the page looks professional, whether the logo is right, whether the wording feels off. You only have to notice the category of thing being asked.

A CAPTCHA is a test the website runs on you. It never needs anything to happen on your computer outside the browser tab. The moment a verification step reaches past the tab and into your operating system (Run box, Terminal, PowerShell, "paste this into…"), the test has stopped being a test.

Worth saying plainly, because the polish is genuinely good now: these pages copy the real checkbox, the real spinner, the real fonts. Judging by appearance will not save you here. Judging by the instruction will.

Is it only a Windows problem?

Mac users have been told for years that the Run box thing doesn't apply to them. It does now, with different keys. In August 2026 Microsoft Threat Intelligence published research on a macOS ClickFix campaign (Microsoft Security Research and Srinivasan Govindarajan, August 5, 2026), where the same social-engineering step ends in Terminal instead of the Run box. The payloads Microsoft named were infostealers including MacSync and Atomic Stealer (AMOS), which Microsoft says harvests credentials, browser and cryptocurrency wallet data, and authentication stores.

Same script, different keyboard. The rule survives the platform change: a verification box should never need your Terminal.

Tell #2: the domain the page is sitting on

The second thing worth looking at is the address bar, because these pages are almost never hosted on anything you have a relationship with.

Microsoft identified more than 250 ClickFix front-end domains during its tracking window, and the naming was mechanical: the token "file" glued to dictionary words. filecopperbasket, filemarblegarden, fileoceanhammer, filevelvettractor. Some variants moved the token around (applefilevault, bananafastfile, orangesmartfile), and some dropped it entirely, like cloudsendhub or syncdatavault.

You are not meant to memorise that list. It rotates. You're meant to notice the shape: a name that means nothing, that you have no relationship with, hosting a "security check" for a brand you do have a relationship with. Those two facts don't belong on the same page.

Sometimes the host is a real site that has been broken into instead. Cribl's SecOps team documented a campaign in August 2026 (Mike Lamb, last edited August 11, 2026) where a compromised WordPress site served a malicious script embedded in its robots.txt file. The script queried the Polygon blockchain through public RPC endpoints and called a smart contract to fetch the address of the next-stage server. Cribl counted 11 domain-rotation transactions tied to a single smart-contract creator, 26 transactions across 4 smart contracts in total, and found the malware carrying 8 different Polygon RPC endpoints as fallbacks (polygon-public.nodies.app, 1rpc.io/matic and polygondrpc.org among them).

The plain-language version: instead of hard-coding where to phone home, the attackers wrote the address into a public blockchain and let the malware look it up, what Cribl describes as a "resilient, censorship-resistant delivery mechanism." Take one domain down and the next one is already published. Cribl attributes the campaign to ClickFix, so the step at the front is the same copy-and-paste routine described above.

Why doesn't a "clean" scan settle it?

This is the part I'd most like people to take away, and it comes with real evidence rather than my opinion.

Microsoft's macOS write-up describes a fingerprinting gate sitting in front of the lure. Before showing anything, the page collects browser and system properties (navigator, screen, window, document, location and console details), reads GPU information through WebGL to tell genuine Apple hardware from a virtual machine, an emulator or a sandbox, and checks the timezone offset, whether it's running inside an iframe, and whether the device supports touch input. It even watches for the tampering patterns that analysis tools leave behind.

Visitors that fail those checks (crawlers, sandboxes, researchers, automated scanners) get a blank page or a harmless decoy. The real lure only appears for what looks like a real person on real hardware.

What if you already pressed the keys?

No lecture here: this catches careful people. Here is what the FTC says to do, in order:

1. Disconnect from the internet. Turn off Wi-Fi or unplug the cable.
2. Run a security scan with your security software.
3. Keep your software updated so known holes get closed.
4. Change your passwords and turn on two-factor authentication, and do it from a different device, since the one you used may still be compromised.
5. Report it at ReportFraud.ftc.gov.

Start with the accounts that hold money or that reset other accounts: your email first, then banking, then anything with a saved card or a wallet.

Where does IP Tracker fit?

IP Tracker is a free Chrome extension. Paste a domain or a full email address into the popup and it gives you a plain-English read on the address itself. The free tier is 50 checks a day, with no account and no tracking; only the value you paste is looked up.

For a page like this one, the useful question is "what is this domain, actually?", and that's what it answers. It checks whether the domain is a lookalike of a widely impersonated brand, including character swaps your eye skips over. It shows whether Google Safe Browsing has flagged it, how many security vendors flag it on VirusTotal, community abuse reports, and the domain's creation date. A domain registered a few days ago, sitting under a name made of stitched-together dictionary words, asking you for keyboard shortcuts, is three separate reasons to close the tab.

It is a second opinion on the address. It is not a shield, and it does not sit between you and the page.

What can't it do?

Being straight about the limits matters more than sounding capable:

• It doesn't read the page. IP Tracker checks the domain, not the content on it. It cannot see that a page is displaying a fake CAPTCHA, and it never will. You have to notice the instruction yourself.
• It can't block anything. It doesn't intercept navigation, doesn't stop a download, doesn't touch your clipboard. It reports; you decide.
• Throwaway domains are often unknown, not flagged. Blocklists need reports, and reports take time. A domain registered this morning for a campaign that rotates hosts daily may be genuinely unreported when you check it.
• Cloaked pages defeat automated checks by design. That's the Microsoft finding above, and it applies to every scanner, not just this one.
• Compromised legitimate sites look legitimate. The Cribl case sat on a real WordPress site. Age, registrar and reputation all look normal, because the domain is normal. Only the content was swapped.

Which loops back to the one tell that never fails. Domains rotate, hosting changes, blockchains hide the next address, pages hide from scanners. The instruction stays the same, because the whole scheme depends on you performing it.

To summarize:

• ✓ A real CAPTCHA is pictures or letters. Nothing else.
• ✓ Windows + R, Ctrl + V, Enter, or "paste this into Terminal", means close the tab.
• ✓ Look at the domain: a nonsense name with no relationship to the brand is the second tell.
• ✓ Already pressed the keys? Disconnect, scan, update, change passwords from another device.
• ✓ Paste the domain into IP Tracker for a fast read on what it is, and remember that quiet isn't the same as clean.

A real CAPTCHA has never once needed your keyboard shortcuts. 😎

Sources

• How to spot a CAPTCHA scam, BCP Staff, Federal Trade Commission Consumer Alerts, June 8, 2026.
• From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide, Microsoft Security Research and Srinivasan Govindarajan, Microsoft Security Blog, August 5, 2026.
• Cribl SecOps uncovers EtherHiding malware campaign on the blockchain, Mike Lamb, Cribl, August 11, 2026.