Scam Detective
Scam verdict · Educational pattern check
Scam Detective research desk · Updated September 2026
Yes — never run it

That “Prove You're Human” CAPTCHA Can Now Open a Tunnel Into Your Whole Network (2026)

Yes — never run it, and it's worse than the password-stealer this trick evolved from. The fake “Verify you are human” page secretly copies a command to your clipboard and talks you into pasting it into Terminal, Command Prompt, or PowerShell. Microsoft's teardown of the new TerminalFix variant (August 28, 2026) shows the command rebuilding malware out of ordinary-looking image files and opening a hidden tunnel into everything else on your network — other computers, file servers, databases. The tell is absolute, per Malwarebytes: a real CAPTCHA will never ask you to open Terminal or PowerShell and paste anything.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL freeRead the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — September 15, 2026 →

Why now · September 2026

Why you’re seeing this now

You've seen the fake “Verify you are human” page that secretly copies a command to your clipboard and talks you into pasting it into Terminal, Command Prompt, or PowerShell. Microsoft has now named a new version of this trick, TerminalFix: after you run the pasted command, it downloads ordinary-looking image files that secretly hide a malicious program inside their pixel data, then rebuilds it on your machine. Instead of just stealing your passwords, TerminalFix opens a hidden tunnel that lets attackers use your computer as a doorway into everything else on your network — other computers, file servers, databases. Microsoft published the technical teardown August 28, 2026, and Malwarebytes followed with the clearest possible tell: a real CAPTCHA will never ask you to open Terminal or PowerShell and paste anything. Apple and Opera have already started building in warnings against exactly this move — a sign of how widespread it's become.

The script · As it arrives — the fake “verify you are human” page

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

“A real CAPTCHA may ask you to click boxes or select images, but it will not ask you to open Run, Terminal, Command Prompt, or PowerShell and paste a command.” — Malwarebytes, Sep 1, 2026.

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

The checklist

Five red flags — any one is enough

A “verification” page asks you to open Run, Terminal, Command Prompt, or PowerShell.
The page silently copies something to your clipboard and tells you to paste it.
You're told to “prove you're human” by pasting and running a command — not clicking boxes or images.
A countdown timer or fake “people verified” counter is pushing you to hurry.
It shows up on a work computer, where the payload's real goal is a foothold into the whole network.
What to do now

Your next three moves

1
Close the page — verification you do yourself is clicking boxes or picking images, never a command. If a site tells you to open Run, Terminal, Command Prompt, or PowerShell to “prove you're human,” that instruction is the malware.
2
Refuse the paste — nothing a webpage silently copied to your clipboard should ever be run. If you already ran it: disconnect the machine from the network, change your important passwords from a different, clean device, and treat the machine as compromised — on a work computer, tell your IT team now, because the payload's goal is a foothold into the whole network.
3
Report the page at reportfraud.ftc.gov and to the FBI at ic3.gov — and paste its link into the $2 instant check before anyone else opens it.
Instant URL Check · $2, one-time
Holding the actual message? Check the exact link, number, or sender.
Paste it into the instant check — free risk signal in 60 seconds, then the full report for $2: a 0–100 scam risk score, a plain-English verdict, the top 5 red flags found, and a 3-step what-to-do-now list. No subscription.
Run the $2 instant check
Follow-up questions

People also ask

What does the pasted command actually do?

Per Microsoft's August 28, 2026 teardown, it downloads ordinary-looking image files that secretly hide a malicious program inside their pixel data, rebuilds that program on your machine, and opens a hidden tunnel attackers can use as a doorway into everything else on your network.

I ran the command on a work laptop — how bad is it?

Treat it as a network incident, not a personal one: the payload's real goal is a foothold into the whole network — other computers, file servers, databases. Disconnect the machine and tell your IT team immediately.

Why did the page feel so convincing?

It rides a moment you see every day — “verify you are human” — and adds pressure props like countdown timers and fake “people verified” counters. Apple and Opera have already started building in warnings against exactly this move, a sign of how widespread it's become.

What will a real CAPTCHA ask me to do?

Click boxes or select images — full stop. A real CAPTCHA will never ask you to open Run, Terminal, Command Prompt, or PowerShell and paste a command.

Related verdicts

People asking this also asked

A website told me to prove I'm human by pressing Windows+R and pasting a command — is it a scam?Yes — scamIs it a scam if a remote job wants me to plug their device into my home WiFi?Yes — scam
← Browse all 218 answers
$2, one time
No subscription, no account, nothing to cancel.
Verdict in minutes
Full report on screen and as a PDF, usually within minutes.
Honest verdicts
If it looks safe, we say so — a clear “safe” is worth $2 too.
Got a link of your own?

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Check a URL free
Spot the scam before it spots you.
For businesses · $19, one-time
Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19
Free brand scan first — you only pay for the full audit.