Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Do not run a command prepared by a website

    Recognise a fake CAPTCHA before a pasted command installs malware or gives someone access to your device.

    Windows users and users of online servicesAbout 5 minutes of reading + 3 questions
    Start with the example Already ran the command?

    What you will learn

    • Distinguish a normal CAPTCHA from a request to run a system command.
    • Stop before executing content placed in your clipboard.
    • Respond if you have already run the command.

    Practice example

    Confirming a booking on a computer

    Page opened from a message
    Confirming a booking on a computer

    To prove you are not a robot, press Windows + R, then Ctrl + V and Enter.

    Fictional example for practice.
    Show the example explanation
    It asks for a system window
    A CAPTCHA runs in the browser and does not need Windows Run, PowerShell or a terminal.
    The command is already in the clipboard
    You cannot clearly see what will run, and a malicious page may have placed it there.
    Execution is framed as a harmless check
    The attacker uses a familiar visual to make you bypass device protections yourself.

    How does the scam work?

    A fake page displays a familiar “I am not a robot” check, then asks you to open a system window and paste a command. The page may already have placed that command in the clipboard. When you press Enter, you are not confirming your identity — you are running content on your computer.

    The attack may begin with a message impersonating a booking service, business portal or other familiar platform. A familiar name does not prove who controls the domain.

    Where does a legitimate check end?

    A legitimate CAPTCHA stays in the browser. It may ask for a click, image selection or another short interaction with the page. It does not need you to:

    • open Windows Run, PowerShell, Command Prompt or a terminal;
    • paste text you did not copy yourself;
    • disable device protection;
    • download a program, extension or profile;
    • allow remote access to your computer.

    Stop if you see any of these requests.

    Check the service safely

    1. Close the tab without following the proposed steps.
    2. Do not return through the same link in the message.
    3. Open the official app or enter a known service address yourself.
    4. If the message mentions an account, booking or payment, check it inside the official account.
    5. Report a work-related message to your IT or security team.

    If you already ran the command

    1. Disconnect the device from the network if you can do so without disrupting a critical process.
    2. Do not enter new passwords or use banking services on that device.
    3. Record the time, page address and steps you took. Do not run the command again to capture evidence.
    4. Contact the relevant technical support or security team for a device review.
    5. From another trusted device, change passwords for accounts used after the event and review active sessions.
    6. Report the incident promptly if business or financial systems may have been accessible.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    A page says Windows + R, Ctrl + V and Enter are part of its CAPTCHA. What do you do?

    Why does this matter? Those steps execute content the page placed in your clipboard, outside the browser's protected context.

    1. Follow the steps because the page shows a familiar logo.

      A copied logo does not establish that the request is safe.

    2. Close the page and open the service through its official app or known address.Correct answer

      Stopping prevents execution, while an independent route lets you check the real service.

    3. Run the command, then close the window immediately.

      A command can take effect immediately; closing the window afterwards is not protection.

    Which request is not part of a normal CAPTCHA?

    Why does this matter? A normal check is completed by an interaction inside the web page.

    1. Choosing images in the browser.

      Image selection can be part of a legitimate check.

    2. Selecting an ‘I am not a robot’ checkbox.

      A checkbox can be part of a legitimate check.

    3. Pasting a command into PowerShell or Windows Run.Correct answer

      A website does not need a system command to establish that you are human.

    You ran the command but nothing visible happened. What is the safest first response?

    Why does this matter? No visible change does not mean malicious software is not running in the background.

    1. Disconnect the device from the network and report the event to the relevant support or security team.Correct answer

      Isolation may limit further communication, while a technical review can determine the next steps.

    2. Keep working until an error message appears.

      Malware can operate without visible symptoms.

    3. Clear browser history and consider the problem solved.

      Clearing history does not remove a command or program that has already run.

    No registration. Your answers are not sent; the result is just for you.

    A CAPTCHA stays in the browser

    Close the page if a check asks for a system shortcut, pasted command, download or installation.

    Recognise fake apps and remote-access requests

    References

    Sources and further reading

    The attack pattern and domain-checking advice are based on the National CERT of the Republic of Serbia warning about fake CAPTCHA checks (Serbia). If the English source route is unavailable, use the language selector on the Serbian authority’s page.

    Content last reviewed