A Fake CAPTCHA Told You to Paste a Command: What to Do Now

The page looked like a routine robot check. It asked you to press a few keys, paste something and hit Enter, and you did, because it sounded like a step in proving you are a person. If that happened in the last few minutes or the last few days, here is what that paste may have done and the order in which to clean up.

Do these three things first

1. Take the computer offline. Turn off Wi-Fi or unplug the network cable. This can interrupt a download that is still running and cuts off a remote connection.
2. Stop signing in to anything on that computer. The FTC’s malware guidance starts here: stop logging into online accounts, such as shopping or banking, until the device is cleaned.
3. Pick up a different device that you trust, such as your phone or another computer. Password changes happen there, not on the machine you are worried about.

None of this means you were careless. The lure is built to look like the hoops you already jump through on many sites, and it is designed so that the person, not a downloaded file, starts the program.

What the page was actually doing

Microsoft Threat Intelligence and Microsoft Defender Experts described the technique in an August 21, 2025 analysis, “Think before you Click(Fix)”. The page tells you to complete a “human verification” by following its instructions. Behind the scenes it has already placed a command on your clipboard. When you paste it into the Windows Run box, Windows Terminal or PowerShell and press Enter, your own computer fetches and starts the attacker’s program.

Microsoft reports that these pages reach people through phishing emails with invoice or payment themes, through malicious ads (including pages opened from free movie streaming sites), and through legitimate websites that criminals compromised and replaced with the lure. So landing on it does not mean you went somewhere unusual. Because a person launches the command, Microsoft says, a campaign can get past conventional and automated security tools, and its researchers saw campaigns targeting thousands of enterprise and end-user devices every day.

What that paste may have installed

You will probably not see anything happen. That is normal for this kind of attack, and it is why the cleanup has to assume the worst until a scan says otherwise.

The cleanup order

1. Scan the computer while it is still offline

The FTC’s malware steps are to update your security software, run a scan and remove what it finds. On Windows, Microsoft’s Windows Security help page recommends the Microsoft Defender Offline scan when you are concerned that your device was exposed to malware. You find it in the Windows Security app under Virus & threat protection, then Scan options. It restarts the computer and scans before Windows loads, which makes it harder for persistent malware to hide. Save open files first. Afterwards, check Protection history for what was found.

If the security software needs updating to have the newest definitions, reconnect only long enough to update, then go offline again for the scan.

2. Change passwords from the clean device

Start with the accounts that can unlock others, then the ones that hold money:

1. Your main email account. Whoever controls it can reset almost everything else.
2. Banking, card and payment app logins.
3. Your password manager, if you use one, and the Microsoft, Apple or Google account tied to the computer.
4. Shopping, social media and work accounts, especially any whose password was saved in the browser.

Turn on two-factor authentication as you go, which the FTC also recommends after malware. In each important account, look for a “sign out of all sessions” or “devices” setting and use it, so a stolen login session stops working.

3. Tell your bank and watch statements

If you used online banking or typed a card number on that computer recently, call the number on the back of the card. Say that your computer may have been infected with password-stealing malware and ask what they recommend, including a new card number. Then review transactions every few days for the next month.

4. Decide whether the computer needs a reset

If the scan found and removed a threat and nothing else looks odd, many people continue using the device while watching it closely. If the scan keeps finding things, settings change on their own, or a remote access tool was involved, a full reset of Windows or macOS, after backing up your documents, is the cleaner route. If this is a work computer, stop here and call your IT or security team before doing anything else; they may need the device untouched.

If someone calls offering to fix it

A pop-up or caller who says they saw the infection and can remove it for a fee is a separate scam layered on top of this one. Our guide to fake security warnings and “refund” calls covers that pattern, and if you have already let a stranger into the computer, the remote-access response guide walks through what to secure.

Report it

• File at ReportFraud.ftc.gov, including the website address where the prompt appeared if you can find it in your browser history.
• If money was taken or an account was used to steal, also file at ic3.gov.
• If a Social Security number or tax files were stored on the computer, follow the steps at IdentityTheft.gov, which the FTC’s scam recovery page points to for exposed personal information.

Accounts to change from another device, in one list

Keep this list next to you while you work through it on your phone or a second computer. Tick each one off only after the new password is saved and two-factor authentication is on.

If you get halfway through and notice an account you cannot log in to anymore, use that service’s official account recovery page, reached by typing its address yourself, and add it to your report.

Sources

• Microsoft Threat Intelligence, Think before you Click(Fix) (August 21, 2025)
• FTC, Malware: How To Protect Against, Detect, and Remove It
• Microsoft Support, Virus and threat protection in the Windows Security app
• FTC, What To Do if You Were Scammed