Scam alert
A CAPTCHA Asks You to Press Keys? Close the Page
Published · United States · consumer.ftc.gov · Arrives by a page in the browser
The short answer
A real CAPTCHA asks you to pick pictures or type a few characters. It does not ask you to open a system box and paste anything. The Federal Trade Commission's June 8, 2026 alert describes pages that look like an ordinary human check and then tell Windows users to press Windows+R, then Ctrl+V, then Enter. Those three keystrokes paste and run a command that was quietly copied to the clipboard, which can load software used to take saved passwords and bank logins. McAfee's September 18 round-up of the same trick, sometimes called ClickFix, is the same rule in one line: if a site asks you to open Run, Terminal, or PowerShell and paste something, stop. Close the tab.
What is happening
The FTC said in June 2026 that it was getting reports of phishing pages dressed as CAPTCHA checks. Instead of matching traffic lights, the page instructs a sequence of keyboard shortcuts that open the Windows Run dialog, paste a hidden command, and execute it. The Commission's recovery steps start with disconnecting from the internet. The pattern has not dropped off. McAfee's September 18, 2026 note described current lures using the same paste-and-run step, including ads and pages that tell people to open Terminal on a Mac or the Run box on Windows. Other September coverage described thousands of otherwise ordinary websites being used to show the fake check. The tell does not depend on which site you were visiting: a genuine human check never needs a system command.
How to recognize it
- A page asks you to prove you are human, then tells you to press Windows+R, Ctrl+V, and Enter, or to open Terminal or PowerShell.
- The instructions mention a Run dialog, a paste step, or a command to execute.
- The CAPTCHA appeared in the middle of ordinary browsing, including on a site you already use.
- Something starts downloading after you follow the keys, or a black window flashes open.
- The page looks like a familiar security widget, which is the part that is easy to copy.
What to do instead
- Close the tab. A real CAPTCHA never asks you to run commands on the computer.
- Do not press Windows+R, Ctrl+V, or Enter because a web page told you to, and do not paste into Terminal or PowerShell for the same reason.
- If you already use a password manager, you can ignore a page that wants a command instead of a click.
- Keep the computer's own security software turned on and up to date, which is the FTC's follow-up after a close call.
- If the page was on a site you trust, try again later or use a bookmark. Compromised sites are one of the ways this is being shown.
If it already happened
Responding to one of these is common and understandable. These steps are what people usually take next.
- Disconnect from the internet first, which is the FTC's opening step, so nothing else can be taken from open sessions.
- From a different device you trust, change the passwords for email and banking, and turn on two-factor authentication where you can.
- Reconnect, update the computer, and run a security scan with software you already have or the device maker's own tools.
- Tell your bank if you think a login may have been used. Report it at ReportFraud.ftc.gov.
Common questions
- I already pressed the keys. What should I do first?
- Unplug from the internet or turn Wi-Fi off, then use a different device to change email and bank passwords. After that, update the computer and run a scan. The order matters because an open connection is what lets a stolen login be used.
- Why would a real CAPTCHA ever need the Run box?
- It would not. Picture-matching and typing a short code are the whole job. Ctrl+V is a paste command, and the FTC's tell is that a security check has no reason to ask for it.
- The CAPTCHA was on a shop I have used for years. How can that happen?
- Some of these pages are shown through sites that were broken into, or through ads, rather than through a shop inventing the trick. The instruction is still the thing to judge, not the address you thought you were visiting.
Practice this safely
Practice closing a fake human-check page instead of typing the keyboard shortcuts it shows.
Every story is fictional. There is no timer, no score, and no real message, payment, or account.
Tell someone
Copy a short note you can paste into a text or email. It names the scam, the next step, and this page. Nothing is sent from this site.
A CAPTCHA Asks You to Press Keys? Close the Page A real CAPTCHA asks you to pick pictures or type a few characters. It does not ask you to open a system box and paste anything. The Federal Trade Commission's June 8, 2026 alert describes pages that look like an ordinary human check and then tell Windows users to press Windows+R, then Ctrl+V, then Enter. Those three keystrokes paste and run a command that was quietly copied to the clipboard, which can load software used to take saved passwords and bank logins. McAfee's September 18 round-up of the same trick, sometimes called ClickFix, is the same rule in one line: if a site asks you to open Run, Terminal, or PowerShell and paste something, stop. Close the tab. Read the full alert: https://endscamsproject.com/latest-scams/captcha-clickfix-malware-scam
Where this comes from
These links open the published sources in a new tab. The destination is shown before you open it.
The full guide on this
More recent alerts
This alert provides general educational information drawn from the sources above. It cannot determine whether a specific message you received is genuine, investigate an incident, or promise recovery or reimbursement.