Captcha-bros.com: what it is and how to remove it
Push notifications are a great way for advertisers to reach potential customers quickly and effectively. But sometimes, this feature can be abused by fraudsters for their gain.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
After a fake CAPTCHA on captcha-bros[.]com, a scan of the PC is a quick first check before you change passwords.
Do it yourself · free Remove Captcha-bros.com yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Captcha-bros.com: summary
| Distribution | Tricking users into allowing to display push notifications, potentially unwanted programs, dubious websites |
|---|---|
| NAME | Captcha-bros.com |
| TYPE | Push notification spam, intrusive ads, and pop-up windows |
| SYMPTOMS | Increased amount in advertiser pop-ups, deceptive notifications, redirects to shady sites |
| DANGERS | Users can get lured into untrustworthy websites and give away their private information or download malware/PUPs |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | Captcha-bros.com |
| Type | Fake CAPTCHA page |
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 4 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | captcha-bros[.]com |
| First seen | 9 August 2021 |
| Facts checked | 6 October 2026 |
What the Captcha-bros.com pop-up looks like
Press Allow to confirm that you are not a robot
Type Allow to verify that you are not a robot
Click Allow to watch the video
Download is ready. Click Allow to download your file
Is the Captcha-bros.com check real?
- Address:
captcha-bros[.]com
From our report of Aug 2021 · not reviewed since
More from our earlier report on Captcha-bros.com
- If you keep seeing annoying pop-up ads, you may have adware.
What the Captcha-bros.com scammers want
From our report of Aug 2021 · not reviewed since
Captcha-bros.com is a website causing users to experience notification spam
Push notifications are a great way for advertisers to reach potential customers quickly and effectively.
But sometimes, this feature can be abused by fraudsters for their gain. Captcha-bros.com shows ads that are deceptive and untrustworthy. It is dangerous to click on these ads because they can link to websites designed to get people's private information or get them to download malicious programs and potentially unwanted applications.
Furthermore, these advertisements delivered by a push notification browser feature are intrusive and annoying, to say the least. They can appear even when the browser is closed, which can cause great pain when trying to use the device. Clicking the "x" button to close the pop-up window will not eliminate the problem. You have to go into your browser settings and completely remove the website that is causing these symptoms.
Upon stumbling on this site, users can be met with a variety of messages. Still, the main purpose is to get people to click the "allow" button to give permission for the website to show notifications and perform other kinds of activities. The message can look something like this:
If you pressed on this "allow" button, you might have noticed that you come across pop-up ads more often. The subject matters could be possibly different too and unusual for you. You could also be experiencing redirects to websites unrelated to what you clicked on in the first place.
There are a few ways users come to these types of websites, but usually, it is not on purpose. Cybercriminals use methods like redirects to get people on their sites.
This often happens when visiting an already shady website, which then directs you to Captcha-bros.com. Clicks generate money for scammers, and they promote legitimate websites alongside malicious ones, so it can be quite difficult to determine if you can trust the website you are on.
Another way people end up on this website is while looking for some type of content for free. This could be movies, videos, software, games, and so on.
But the most common thing that happens is users experience this because of PUPs . This way, people get the most confused and do not understand where the problem came from.
To remove Captcha-bros.com from your browser, you can do this manually by following the guide below, or if you cannot figure it out alone, , are there to help.
Remove unwanted notifications from Google Chrome (desktop):
Remove unwanted notifications from Google Chrome (Android):
You can find instructions on how to remove notifications in other search engines at the end of this post.
- Open Google Chrome browser and go to Menu > Settings.
- Locate Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
From our report of Aug 2021 · not reviewed since
Software bundling is the most common way users get infected by malicious websites
Bundled software is a term used to describe a set of programs that are sold or provided for free together.
Most commonly, this happens when people are looking for a free version of a program because they do not want to buy it. Users find these programs on third-party distributor websites that are untrustworthy.
That is how users overlook the additional programs included in the package that are unneeded. It would help if you were careful when downloading anything onto your system because it can end up in a lot of trouble for you.
In the installation process, read through the steps carefully, look if there are any other programs besides the one you want to get. If there are, be sure to uncheck the boxes beside them.
If you do not ensure you are not installing any additional, unrelated software, you might get yourself a potentially unwanted program (PUP). These kinds of programs look like they provide a lot of value for the user, but they can be semi-functional or not functioning at all as advertised and perform additional undesirable tasks in the background without the person knowing about it.
If you tried to remove notifications from your browser and it was unsuccessful, you can try resetting your browser altogether.
Reset Google Chrome:
- Click on Menu and select Settings.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
From our report of Aug 2021 · not reviewed since
Different ways PUPs operate on your device
PUPs are capable of collecting user data and using it as they seem fit, changing browser and system settings.
If users do not know that they got the PUP via software bundling, they might be confused when they notice sudden changes in their web surfing experience. Sometimes it can get quite difficult for people to determine the root of the problem and how they got it.
The installation of a PUP can result in an increased amount of pop-ups while browsing the internet. These ads might look like legitimate ones and lead users into installing more PUPs or more dangerous malicious applications. If you do not know how to differentiate real advertisements from those created by scammers, you can try determining if:
- The grammar and spelling on the advertisement is correct
- The design and imaging looks professional
- The website showing you the ad matches the one it is suggesting you go to
- The ad matches your interests and your browsing behavior.
What to do if you ran the Captcha-bros.com command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Captcha-bros.com gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Captcha-bros.com that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Captcha-bros.com can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Captcha-bros.com add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Questions about Captcha-bros.com
I only saw the captcha-bros[.]com CAPTCHA and closed it. Is that safe?
Yes. The page on captcha-bros[.]com copies a command to your clipboard, but a clipboard does nothing on its own. Unless you opened the Run box, PowerShell or Terminal and pasted it, nothing ran.
To be tidy, copy some harmless text so the command is no longer on the clipboard, and if clipboard history is on, delete the entry with Win+V. Then think about how you reached the page:
- a hacked site
- an ad
- a link in a message
If notifications from strange sites keep opening pages like it, remove them in the browser settings.
Could Windows Security have stopped the captcha-bros[.]com command?
Sometimes. Microsoft Defender blocks many known ClickFix scripts and payloads, and Protection history in Windows Security will show it if it did. But campaigns change quickly, and a command you ran yourself starts with your permissions, so a new variant can get through before signatures catch up.
Check Protection history for entries from the time you visited captcha-bros[.]com. Whatever it shows, run an offline scan, look for new startup items and change your important passwords from another device, because stealers act fast and what they took cannot be called back by a later detection.
Does a human-verification check know about Captcha-bros.com?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening captcha-bros[.]com?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Captcha-bros.com use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
The page will not close. What can I do?
Press Esc to leave full-screen mode, then close the tab. If the browser is frozen, open Task Manager with Ctrl + Shift + Esc, select the browser and click End task. When you restart the browser, do not restore tabs.
If the page loads again on start, open a new window and close the old one, then remove the page from the browser's startup settings. Restarting the PC also works. Nothing was installed by the page, so closing it by force is safe and loses nothing.
Do I need to reset my router because of Captcha-bros.com?
No. Fake alert pages work inside the browser and do not change router settings. The sign reported is A fake CAPTCHA on captcha-bros[.]com that asks you to paste a command, which comes from a web page, not from the network. Resetting the router will not stop it.
What stops it is removing the browser permission, extension or program that opens the page. If you see the same page on every device in the house without visiting the same sites, that is unusual and worth checking the router's DNS settings, but it is not what has been reported here.
Which browser settings protect against fake alerts?
Three matter most. First, notifications: set your browser to ask before allowing them, and block sites you do not trust. Second, reputation checks: SmartScreen in Edge and Safe Browsing in Chrome warn you before known scam pages load, and Firefox has its own deceptive-content protection under Privacy & Security.
Third, pop-ups and redirects: keep the default blocking on. Add a reputable ad blocker if fake alerts keep reaching you through ads on sites you use. Review the notification list every few months.
Why is pasting a command so dangerous?
Because it skips every protection that would stop a normal download. Browsers check files you download and SmartScreen checks programs you open, but a command you type yourself is trusted as your own action. Pages like Captcha-bros.com exploit exactly this.
The command fetches and runs code in memory, often leaving little on the disk for a quick scan to find. That is why the advice is absolute: no website has a legitimate reason to make you paste anything into Run, Terminal or PowerShell.
Will Fortect remove Captcha-bros.com?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Captcha-bros.com, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- M&H Consulting: Dangers of Installing Third-Party Programs (read October 6, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)