Moatline

A website asked you to press Windows + R to “verify you are human”? Here’s what to do

Real CAPTCHA checks never ask you to open the Run box, Terminal or PowerShell and paste something. If a website did, it has been hacked to spread malware. Here is what to do, depending on how far you got.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 3 min read

It’s a scam

The box looks like a normal “I’m not a robot” check, often with a Cloudflare or Google logo. Then it asks you to:

  • press Windows + R (or open Terminal on a Mac),
  • press Ctrl + V to paste,
  • and press Enter.

What you paste is a command that downloads malware, usually a “stealer” that takes saved passwords, browser logins, cookies and crypto wallets. Security researchers call this ClickFix. No genuine website check ever works this way.

If you didn’t run anything

You’re fine. Close the tab, and copy any ordinary text so the command is no longer on your clipboard. Then consider telling the site owner: their site is hacked and other visitors may not be as careful.

If you ran the command

Act now. Stealers work in seconds, so assume your saved passwords and logged-in accounts are exposed and work through these steps in order.
  1. Disconnect the computer from the internet (Wi-Fi off or cable out) to stop anything else being sent or downloaded.
  2. If it’s a work computer, tell your IT team straight away. Don’t try to fix it yourself.
  3. From a different device (your phone or another computer), change passwords, starting with your email, then banking, then everything else that was saved in the browser or a password manager on that computer. Use “sign out of all devices” wherever it’s offered, because stolen login cookies can work even after a password change.
  4. Turn on two-step verification for your email, bank and social accounts, if it isn’t already on.
  5. Crypto wallets: from a clean device, move funds to a brand-new wallet. Treat the old seed phrase as stolen.
  6. Scan the computer. On Windows, open Windows Security → Virus & threat protection → Scan options and run the Microsoft Defender Offline scan. If anything is found, or you’re unsure, have the computer checked or reset by a professional. A full reset is the only way to be certain.
  7. Watch your bank statements and accounts for the next few weeks, and tell your bank if you see anything you don’t recognise.

Warn the site owner

The owner almost certainly doesn’t know: these fake checks hide from phones, from logged-in owners and from anyone who has seen them once. Use the contact form or email on their site (from your clean device), or message them on social media. You can copy this:

Hi, I wanted to let you know your website may be hacked.
When I visited [page address] on [date], it showed a fake
"verify you are human" box asking me to press Windows + R
and paste a command. This is a known malware attack called
ClickFix. It may only show on desktop computers, so you
might not see it yourself.
This guide explains how to find and remove it:
https://moatline.io/guides/wordpress-fake-captcha-malware

You can also report the page with Google Safe Browsing’s report form, so Chrome can warn other visitors.

If you run a website yourself, our guide to removing fake CAPTCHA malware from WordPress and our real cleanup case show how these scripts hide.

Frequently asked questions

I only clicked the checkbox. Am I infected?
Clicking the box itself usually just copies a command to your clipboard. Nothing runs unless you then paste it into the Run box, Terminal or PowerShell and press Enter. If you didn’t do that, close the page and copy some ordinary text so the command is no longer on your clipboard.
Will my antivirus catch it?
Sometimes, but not always. These attacks change often to stay ahead of antivirus updates. Run a full scan anyway, but if you ran the command, change your passwords from another device whatever the scan says.
Does this happen on Mac?
Yes. Mac versions ask you to open Terminal and paste a command. The advice is the same: if you ran it, disconnect, change passwords from another device and get the Mac checked.
Is the website owner trying to scam me?
Almost never. The site was hacked, and its owner usually doesn’t know, because the fake check hides from them. Telling them is the kindest thing you can do.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →