‘Verify You’re Human’ Popup That Ran Commands: A Fountainbridge Guide

A fake CAPTCHA told you to press Win+R and paste something to prove you weren’t a robot. What actually ran, what was taken, and how a Fountainbridge tech puts it right.

26 September 2026 8 min read Cybersecurity Alex M.
A fake ‘verify you are human’ CAPTCHA popup on a laptop in a Fountainbridge flat, instructing the user to press Windows plus R and paste a command

A customer in Fountainbridge rang last month convinced her laptop was fine. She’d only clicked “verify you’re human” on a video-streaming site, pasted the little snippet the page told her to run, and pressed Return. Twenty minutes later her bank sent a text about a login attempt from another country. The popup she trusted has a name in the security world — ClickFix — and it is one of the most successful malware delivery techniques of the last year. If you’ve done the same thing, or you think you might have done, this guide is what we tell every Fountainbridge caller who lands on that page.

If a command has already run and you’re on a laptop with saved banking passwords, don’t keep using it. Get it off the internet, then book our virus and malware removal team — the sooner an infected machine goes on aeroplane mode, the less the intruders can quietly take.

What the Fake ‘Verify You’re Human’ Popup Actually Does

The trick is short, elegant and effective. You land on a page — a lookalike news site, a fake Cloudflare check, a “download this document” prompt, a search result that looked like it went to a genuine video, or an ad injected into a pirated streaming page. A little dialog appears saying you need to prove you’re not a robot: press Windows + R, then Ctrl + V, then Return. The page has already copied a PowerShell one-liner to your clipboard while your back was turned. You paste it, press Return, and the command runs quietly, in your own user account, with full network access.

Security researchers call this social-engineering pattern ClickFix. It bypasses every browser sandbox, every Chrome download warning, every SmartScreen alert, because the code isn’t being downloaded — it’s being pasted by you. Windows sees the user pressing Return on a Run dialog and does exactly what it’s told to. That’s the whole clever bit: the attack rides on your keyboard, not the browser’s permissions.

How ClickFix Reaches Fountainbridge Home PCs

Every case we’ve had in from around Fountainbridge, Tollcross and Haymarket this year has come through one of four routes. Unofficial streaming sites for football and films that promised no subscription and delivered a payload instead; search results for cracked apps or Office activators; fake “your document requires verification” pages served through poisoned Google Ads; and phishing emails with a QR code that leads to a mobile page, then a browser tab on the desktop.

The final payload varies. Most often we see info-stealers — malware families like Lumma, Vidar or StealC — that within seconds copy every saved browser password, cookie, autofill card and cryptocurrency wallet, then upload the lot to an attacker’s server or a Telegram bot. Session cookies are especially painful: because they’re valid authentication tokens, an attacker can log in as you without your password for as long as those sessions live — often days.

Signs the Command Already Ran

The scariest thing about ClickFix is that on the surface, nothing looks wrong. There’s no fake antivirus popup, no locked-out desktop, no wallpaper change. The PC is behaving normally because the whole point is stealth. Still, there are tells if you know where to look:

  • Windows Run history. Press Win + R and look at the dropdown. If you see a long powershell.exe -w hidden … or mshta … entry you don’t remember typing, that’s it.
  • A brief flash of a blue console window at the moment you pressed Return.
  • Chrome or Edge asks you to sign back in to Google or Microsoft a day or two later — the platform detected the stolen session as anomalous and killed it.
  • Your bank, PayPal or a crypto exchange sends an unexpected login-from-somewhere-else notification.
  • Task Manager shows a MSHTA.exe, wscript.exe or powershell.exe you didn’t start.

A Fountainbridge Bench Story

The Fountainbridge case that changed how we run the diagnostic was in July. A tenant in one of the canal-side flats brought in a laptop that “just seemed a bit slow”. She hadn’t mentioned the CAPTCHA — she’d genuinely forgotten she’d done anything unusual. Full scans came back clean; Windows Defender had already deleted the initial dropper. What we found instead was every saved password gone from her Chrome profile (extracted, then wiped so no popup would appear), five active sessions in her Google account from IP addresses in three different countries, and a scheduled task set to re-run the payload on the next reboot.

Two lessons landed. First, “the antivirus quarantined it” is not the same as “you’re safe” — an info-stealer only needs to run once, and its whole job is done in the first thirty seconds, before Defender finishes reacting. Second, we now insist every ClickFix customer opens their Google or Microsoft security dashboard before the machine leaves the bench: rotating passwords is pointless if the attacker still holds an active session cookie. Sign out of every device from that dashboard, then change the password, then sign back in. That’s the sequence that actually kills the intrusion — and it’s the sequence we now walk every customer through in person.

What to Do Right Now If You Pasted the Command

If the popup happened in the last few hours and you’re reading this on the same PC:

  • Disconnect the PC from the internet. Pull the Ethernet cable or turn Wi-Fi off from the taskbar. Don’t shut the PC down — some persistence traps only trigger on reboot.
  • From a different, trusted device — your phone on mobile data, or a family member’s laptop — open your Google or Microsoft account security page. Sign out of every session and every device except the one you’re on, then change the password.
  • Then do the same for your bank, email, PayPal, cryptocurrency exchange and Amazon, in that order. Anything with a card number or a payout method saved.
  • Ring your bank’s fraud line on the number printed on the back of your card if you saw a real transaction alert. Don’t ring any number the popup gave you — those are secondary scams. The same discipline we describe in our tech support scams in Edinburgh guide applies here.
  • Change any password you reused across sites. Info-stealers extract the lot and try them against every popular service — automated, and usually within hours.

The Deeper Clean-Up That Comes Next

Getting the accounts back under your control is the emergency. Cleaning the PC properly is the next day’s job. On the bench we go through the persistence mechanisms these families use before we hand a machine back to anyone:

  • Scheduled Tasks and Registry Run keys — where the payload re-installs itself at every boot.
  • Startup folder entries and any newly created Windows services.
  • AutoIt or Nim droppers hidden in a fake %ProgramData% folder with a benign-sounding name like Nvidia, Realtek or Adobe.
  • Browser extensions and profiles — a fresh Chrome or Edge profile is usually faster than trying to prove one is clean.
  • DNS settings and browser proxies — some campaigns re-route search results through their own servers so results stay poisoned until you notice.

If the payload dropped a rootkit or an unsigned kernel driver, we sometimes recommend a clean OS installation instead of a manual clean. It’s not the first answer for a home PC — the migration takes an evening — but it is the honest answer when a rootkit is in play. That’s a judgement call we won’t fake on a bench inspection: we’ll tell you which pile the machine is in and let you choose.

How to Stop It Happening Again

Three habits close ClickFix off almost completely:

  • Never type in a Run box on the say-so of a website. A real Windows dialog will never ask you to. If any page — CAPTCHA, download, “verification” — instructs you to press Win + R, close the tab and forget the page existed.
  • Use a proper password manager so you’re not relying on the browser to remember everything. Info-stealers do read browser password stores directly — a separate manager with a strong master password limits how much can walk out in one grab.
  • DNS-based filtering at the router (NextDNS, Quad9, or a Pi-hole) blocks a lot of the ad-injected redirects that host the fake CAPTCHA pages in the first place. Our post on browser pop-ups that appear even after you close the browser covers the wider “something rewrote my browser” family. If the initial vector was a fake “your browser is out of date” overlay rather than a fake CAPTCHA, our fake browser update popup guide is a closer match. And if the pop-ups arrived after a full-blown Chrome browser hijacker took over your new-tab search, that guide covers cleaning it out.

When to Bring It to a Professional

If any of these apply, don’t try to clean it yourself: banking or crypto accounts were accessed; the PC is a work machine or holds client data; you can’t rotate passwords on a separate trusted device; you’re not sure whether the command actually ran. We handle this kind of clean-up at our workshop and via virus removal in Fountainbridge — with a same-day or next-day turnaround — and we can troubleshoot the Windows Security, browser and account settings that ClickFix disables to get itself running. Slow down, verify off-device, then clean: that’s the sequence that actually works.

Last updated: 26 September 2026

Frequently Asked Questions

What Fountainbridge callers ask us after pasting a command from a fake “verify you’re human” popup.

Not necessarily. An info-stealer’s whole job — copying saved passwords, cookies and cards — is usually done in the first thirty seconds, before any antivirus finishes reacting. Defender removing the dropper afterwards protects the PC from reinfection, but doesn’t undo what already left. You still need to sign every device out of Google or Microsoft, rotate the important passwords, and watch your bank for a few weeks.

Every password that was saved in the browser on that PC, yes — and any password you reused elsewhere. Start with email (because it can reset every other account), then banking, then anything with a card number or a payout method. If you use a password manager, its own master password goes first. Do it all from a different device, not the one that was compromised.

Rarely with certainty. Info-stealer families upload the data and then wipe their tracks, so a full forensic reconstruction usually isn’t possible on a home PC. What we can do is check the Windows event logs and browser artefacts for the moment the command ran, name the family, and tell you which categories these families typically grab — saved passwords, cookies, autofill, cryptocurrency wallets, Discord and gaming tokens. That’s enough to prioritise which accounts you rotate first.

Most home PCs are same-day or overnight at the workshop. The variables are how much persistence the payload left behind, and whether we find any evidence of a rootkit — that’s the point at which a rebuild becomes cleaner than a manual clean. We’ll ring you with the finding before we start any work that changes the way you use the machine.

Pasted Something From a Fake CAPTCHA?

Book a Fountainbridge visit or drop the machine in — we’ll clean the persistence, help you rotate the accounts, and hand back a PC that’s safe to bank on again.

Book a Repair Contact Us