Free tools Windows power users keep installed
One-click scans. No signup required.
A CAPTCHA should ask you to solve a challenge in the browser, such as selecting images or typing displayed characters. If a supposed verification page tells you to open Run, Terminal, PowerShell, Command Prompt, or another system utility and paste or run text, stop. The Federal Trade Commission puts it plainly: “Real CAPTCHAs won’t ask you to run commands on your device.”
What makes a CAPTCHA or verification page suspicious?
Focus on what the page asks you to do, not whether it looks convincing. A challenge that stays in the browser is different from instructions that make you operate your device.
| What the page asks | What to do |
|---|---|
| Select images, match a visual puzzle, or type characters shown in the browser | These are ordinary CAPTCHA tasks. Check that the page and the reason for the challenge make sense, but appearance alone does not prove the page is legitimate. |
| Open Windows Run, Command Prompt, PowerShell, Mac Terminal, or another system utility | Stop. This is not a normal CAPTCHA step. |
| Paste text or a command, press a sequence of keys, or run something to prove you are human | Do not follow the instructions or execute the text. A page asking you to operate your system or clipboard is a strong warning sign. |
The University of Oregon Information Security Office warns: “You should never copy and paste or drag and drop to complete a CAPTCHA!”
Why a familiar-looking verification page can still be fake
Visual design and familiar branding are not reliable proof. Microsoft has documented ClickFix lures that imitate Google reCAPTCHA and Cloudflare Turnstile, as well as other familiar verification interfaces. A page can copy the look of a legitimate service while asking you to do something that a real CAPTCHA would not ask.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The route to the page may be deceptive, too. Microsoft describes ClickFix lures arriving through phishing, malicious advertising, or compromised websites. A site you have visited before—or one that was legitimate previously—could have been compromised, so familiarity with the address or brand is not enough to make unusual instructions safe.
How a ClickFix fake CAPTCHA works
ClickFix is a social-engineering tactic: instead of relying only on an automatic download, attackers try to persuade the visitor to launch a command themselves. The page may frame the request as a CAPTCHA, routine technical problem, or update notice.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- A visitor lands on a deceptive page, sometimes through phishing, an ad, or a compromised site.
- The page displays a verification-looking widget or other prompt and may copy obfuscated text to the clipboard when the visitor interacts with it.
- It instructs the visitor to open a system utility and paste or execute the clipboard contents. The page may coach the person through keyboard shortcuts, such as Windows + R, Ctrl + V, and Enter.
The FTC identifies that shortcut sequence as an example of a CAPTCHA scam. Do not paste clipboard contents supplied by a page into a system prompt, and do not try to inspect or run an unfamiliar command. Close the page instead.
What to do if you already followed the instructions
Seeing a suspicious page is not, by itself, proof that your device is infected. The risk changes if you ran the command or downloaded something. If you did, act promptly and follow the FTC’s general guidance:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Disconnect the affected device from the internet.
- Run a security scan.
- Update your software and apps.
- Using a different device, change your passwords and enable two-factor authentication in case credentials were exposed.
- Report a suspected scam page at ReportFraud.ftc.gov.
The FTC warns that stolen information can include email login details and mobile banking credentials. If you entered account information, prioritize protecting those accounts from a separate, trusted device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How widespread is this tactic?
A historical figure should not be mistaken for a current total. In an October 29, 2024 alert, the U.S. Department of Health and Human Services Health Sector Cybersecurity Coordination Center (HC3) reported that a TA571 campaign, which began in March 2024, sent over 100,000 emails and targeted thousands of organizations globally. That number describes the reported scale of that campaign, not the total or current prevalence of ClickFix attacks.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
