A CAPTCHA is supposed to ask the website a question about you.
It is not supposed to ask you to operate the computer on the website’s behalf.
Microsoft has documented a social-engineering technique known as ClickFix in which attackers imitate familiar human-verification pages such as CAPTCHA, reCAPTCHA, or Cloudflare-style checks. Instead of merely asking the visitor to click a box or solve a challenge, the fake page gives instructions that lead the user into running a command on the computer.
See Microsoft’s analysis of ClickFix.
The request stops matching the job
A legitimate human-verification challenge exists to distinguish a person from automated traffic.
It may ask you to click a checkbox, identify images, wait briefly, or complete some other interaction inside the browser.
The fake version changes the assignment.
It might tell you to open a system dialog, paste something from the clipboard, launch a terminal, or perform some unrelated sequence of operating-system actions. Microsoft says ClickFix campaigns use exactly this mismatch to get users to initiate the infection themselves.
That is the useful warning sign: the “verification” begins asking for capabilities that a normal CAPTCHA does not need.
Familiarity lowers suspicion
CAPTCHAs are annoying but ordinary. People have been trained to comply with them quickly because they appear during sign-ins, downloads, ticket purchases and other routine web tasks.
Attackers borrow that muscle memory.
Microsoft has observed fake CAPTCHA pages used in campaigns that ultimately install information-stealing malware or remote-access software. Its security intelligence also classifies fake CAPTCHA behavior as a social-engineering technique rather than a real verification system.
See Microsoft’s FakeCaptcha threat description.
A CAPTCHA should stay in its lane
If a human-verification page suddenly asks you to open Windows Run, PowerShell, Terminal, or another system tool and paste or execute something, stop.
Do not finish the instructions merely because the page says they are required.
Close the page and return to the service through its known address. If the site genuinely requires verification, it can present a normal challenge again.
The fake CAPTCHA depends on one assumption: that a familiar box labeled I am not a robot will make every instruction beneath it feel equally legitimate.
It should not.
The moment the test asks you to become the installer, the test has changed.