A website told me to prove I'm human by pressing Windows+R and pasting a command — is it a scam?

Yes. Real CAPTCHAs never ask you to open the Run box or Terminal, and never ask you to paste anything — a page that does is running the “ClickFix” play: the verify button quietly copies a command onto your clipboard, and pasting it installs infostealer malware with your own hands. Close the tab without pasting, and if you already ran the command, disconnect from the internet and run a full malware scan from a known-clean device.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — August 12, 2026 →