'Verify you are human...': This fake verification page can steal your passwords in seconds

A Reddit user’s warning about a suspicious “Cloudflare” verification prompt is sparking serious cybersecurity concerns online.

Posted in the r/IndiaTech subreddit by user iampushpak, the image shows a seemingly legitimate Cloudflare verification screen asking users to press Windows + R, paste a command, and hit enter to "verify" they’re not a robot. However, the instructions are not part of any known Cloudflare human verification protocol and have prompted alarm among tech-savvy users.

In a wave of comments, Redditors quickly identified the prompt as a potential scam designed to trick users into executing malicious code on their systems.

“Password stealer, don’t even think of following those steps,” warned one user.

Another explained the risk further: “Don’t don’t bro, websites can change ur clipboard contents and by pasting it on that run would execute unknown and probably harmful program. Just don’t do it.”

Other users suggested the site may have been spoofed and requested more information to investigate the threat, including the full URL. One user bluntly summarised the risk: “Yep, basically will give attackers remote access to your PC.”

While Cloudflare is known to implement browser-based security challenges such as CAPTCHA verifications, JavaScript checks, or waiting rooms, these are always handled within the browser. In rare cases, users might encounter challenges like “Verify you are human” pages when trying to access sites protected by Cloudflare’s DDoS mitigation or bot protection systems. But under no circumstance does Cloudflare ask users to interact with their operating system directly, open the Run dialogue, or paste and execute commands.

If a site claims to be Cloudflare-protected and instructs you to interact with Windows outside the browser, it is not legitimate. 

The incident is a stark reminder of the increasingly sophisticated nature of social engineering attacks. Fake security prompts are evolving to resemble legitimate services in design and tone, making it crucial for users to verify URLs, check for HTTPS, and look out for irregularities in process flow.