Warning: Fake 'verify you are human' pages spreading malware

A wave of malicious pages is presenting visitors with convincing 'verify you are human' dialogs that closely mimic legitimate CAPTCHA checks. Instead of clicking an image grid, users are instructed to open the Windows Run dialog or a terminal and paste text that has already been placed on their clipboard by the page.

The pasted text is a system command that downloads and runs malware — often an infostealer or remote-access trojan. The technique, sometimes called ClickFix, has been used to target people via compromised websites, malicious ads, and phishing emails that link to fake document or software pages.

No legitimate site ever needs you to run a command in your terminal to prove you are human. If any website or pop-up asks you to open Run, PowerShell, Terminal, or a command prompt and paste something, close the page immediately.