Some fake CAPTCHAs tell you to press Windows + R (or open Terminal), paste something in and hit Enter ‘to prove you’re human’. That’s not a human check — it’s you installing the malware yourself. They turn up on legit sites too, so the tell isn’t the site, it’s the ask: a real CAPTCHA never asks you to do anything outside the browser.
The move
If a ‘human check’ wants you to press keys, paste or run anything outside the browser, close the tab. Already done it? Go offline, run a virus scan, and change your passwords from a different device.
Seen via Which?