Captcha-smart.top: what it is and how to remove it
Captcha-smart.top is an attempt to make passive income by using social engineering techniques. The website displays a fake message in order to get people to click the "Allow" button, which grants permission for the site to spam users with pop-up ads.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If you ran the command from captcha-smart[.]top, a free scan can check startup items, tasks and programs that loaders usually add.
Do it yourself · free Remove Captcha-smart.top yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Captcha-smart.top: summary
| Distribution | Shady websites, redirects, deceptive ads, freeware installations |
|---|---|
| NAME | Captcha-smart.top |
| TYPE | Push notification spam; potentially unwanted program |
| SYMPTOMS | Push notifications start showing up in the corner of the screen seemingly out of nowhere |
| DANGERS | Pop-ups can lead to questionable pages that can put users at risk |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | Captcha-smart.top |
| Type | Fake CAPTCHA page |
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 4 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | captcha-smart[.]top |
| First seen | 11 October 2021 |
| Facts checked | 6 October 2026 |
Is the Captcha-smart.top check real?
- Address:
captcha-smart[.]top
From our report of Oct 2021 · not reviewed since
More from our earlier report on Captcha-smart.top
- You can block push notifications via browser settings; scan the machine with anti-malware tools to make sure there is no adware operating in the background
What to do if you ran the Captcha-smart.top command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Captcha-smart.top gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Captcha-smart.top that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Captcha-smart.top can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Captcha-smart.top add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
From our report of Oct 2021 · not reviewed since
Captcha-smart.top leads people to believe it is a captcha verification step
Captcha-smart.top is an attempt to make passive income by using social engineering techniques.
The website displays a fake message in order to get people to click the "Allow" button, which grants permission for the site to spam users with pop-up ads. Unfortunately, the ads that start showing up also cannot be trusted, as the authors of the page do not filter them.
As a result, links embedded in the notification prompts can lead to dangerous websites where users are at risk of providing their personal information to the wrong people and suffering from monetary losses or downloading PUPs (potentially unwanted programs) and malware.
Push notifications were first introduced by Apple in 2009 and were meant to give an ability for websites, apps to inform their users about the latest news, updates, special offers, etc. The invention of PPC advertising created a perfect combination for fraudsters to exploit people.
Not many people like to get spammed with advertisements constantly, so shady individuals came up with ways to trick people and make them oblivious to what they are doing.
Because push notifications are based on a subscription model, only users themselves can allow them and block them. But with the use of deceptive methods, many people do not even realize that what they are experiencing are push notifications. Because they seem to appear seemingly out of nowhere, many think that they have been infected with a virus.
People rarely find pages like this in their search results. Most commonly people get redirected from other shady sites by clicking on the wrong thing. This could be a deceptive ad or an invisible redirect. We can strongly say that most of the time people experience push notification spam because of their carelessness.
Besides having to "Click Allow to confirm that you are not a robot," you can come across many other different messages tempting you to click:
Captcha-smart.top is not the only website created to put phishing techniques to use. We write about these types of websites every day. Hundreds of them are terminated and hundreds of them take the previous ones' places. Some of the previous ones we already wrote about are Ofslakotha.com, Wholehugewords.com, and Defimedia.best.
- Download is ready. Click Allow to download your file
- Click Allow to verify that you are 18+
- Click Allow to watch the video
From our report of Oct 2021 · not reviewed since
Privacy concerns
Almost every website you visit uses cookies to track your browsing activity.
Because pop-up ads that you start seeing can come from untrustworthy sources, your information can be used in many ways that you do not want it to be used. Pages can see your IP address, what links you click on and what you purchase. They can create your profile and later sell it to advertising networks that want you to spend money on their clients.
Unfortunately, if you visited a lot of questionable sites, it might also clog up your device making it run slower than before. There is an automatic solution to this problem - .
This powerful tool can clear your browsers, optimize the machine, and also fix various system errors, corrupted files, registry issues, etc. So it is useful for more than one thing. If you are interested, we suggest scanning your machine with it after you remove push notifications.
From our report of Oct 2021 · not reviewed since
Start the removal process by going to your browser settings
As we mentioned before, only you can grant permission for a website to start sending you push notifications, so you have to block them manually too.
You can find the instructions for the most popular browsers below:
Google Chrome (desktop):
Google Chrome (Android):
MS Edge (Chromium):
- Open Google Chrome browser and go to Menu > Settings.
- Locate the Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
- Open Mozilla Firefox and go to Menu > Options.
- Click on Privacy & Security section.
- Under Permissions, you should be able to see Notifications. Click Settings button next to it.
- In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
- Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
- Click on Safari > Preferences...
- Go to Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
- Open Microsoft Edge, and go to Settings.
- Select Site permissions.
- Go to Notifications on the right.
- Under Allow, you will find the unwanted entry.
- Click on More actions and select Block.
- Open Internet Explorer, and click on the Gear icon at the top-right on the window.
- Select Internet options and go to Privacy tab.
- In the Pop-up Blocker section, click on Settings.
- Locate web address in question under Allowed sites and pick Remove.
From our report of Oct 2021 · not reviewed since
If you have other symptoms it might be adware
If you tried to block push notifications manually, and it did not work, that could mean that you have adware operating in your system.
Adware is a PUA that performs various processes in the background. In this case, you could be experiencing pop-up ads, redirects to questionable pages, and an overall increase of commercial content, like banners, surveys, etc.
In that case, simply blocking. the notifications will not work. You will keep experiencing the symptoms until you locate the PUP and eliminate it completely. It can be hard to identify a PUA yourself if you do not have experience. It might be disguised as a "handy" program that you think provides a lot of value to you.
That is why we always recommend our readers use a professional security tool to scan the device. or will do a great job at that. It can also help you avoid such infections in the future by warning you about suspicious files you are trying to install.
If you definitely know, which app is responsible, you can proceed by following guides for Windows and Mac machines:
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till uninstallation process is complete and click OK.
- Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
- Pick the unwanted application by clicking on it once.
- At the top, click Uninstall/Change.
- In the confirmation prompt, pick Yes.
- Click OK once the removal process is finished.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
Questions about Captcha-smart.top
What did the captcha-smart[.]top verification command do?
In ClickFix campaigns the pasted line starts a hidden PowerShell, mshta or curl process that fetches a script from a remote server and runs it. That script installs the real payload, most often an information stealer, sometimes a remote access tool or a loader that brings more malware later.
The exact payload of captcha-smart[.]top can change from day to day, which is why the safe response does not depend on knowing it: scan offline, remove what was added and change passwords from another device. Look in the Run box history with Win+R to confirm the command was executed.
Why does captcha-smart[.]top ask me to run a command to prove I am human?
Because the command is the attack. Real human checks, from Google, Cloudflare or anyone else, only ask you to click or solve a puzzle inside the page; none ever needs the Windows Run box. Criminals use this trick, called ClickFix, because browsers block malicious downloads but cannot stop you from running something yourself.
The page on captcha-smart[.]top mimics a familiar verification box to make the request feel routine. If any page asks you to press Win+R, open PowerShell or paste anything into Windows, close it. That one rule defeats every ClickFix page.
Does a human-verification check know about Captcha-smart.top?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening captcha-smart[.]top?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Captcha-smart.top use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
I closed it, but it appeared again the next day. Why?
A page that returns on its own has a trigger. Look at how it appeared: from a pop-up in the corner of the screen means a notification permission; on start-up means a session restore or a changed start page; while browsing any site means an extension; on one particular site means that site's ads.
Each has a quick fix in the browser settings. If none of them explains it, reset the browser, which clears permissions, extensions and start pages together.
Can Captcha-smart.top harm my PC just by being open?
No. A web page runs inside the browser's sandbox and cannot install programs, read your files or change Windows settings on its own. Captcha-smart.top can only make noise, fill the screen and try to persuade you. The risk begins when you follow it:
- calling the number
- paying
- downloading a file
- pasting a command
Close the page, and if it frightened you into doing one of those, follow the matching steps in this guide. Otherwise, nothing on the PC needs cleaning or repairing.
Do I need to reset my router because of Captcha-smart.top?
No. Fake alert pages work inside the browser and do not change router settings. The sign reported is A fake CAPTCHA on captcha-smart[.]top that asks you to paste a command, which comes from a web page, not from the network. Resetting the router will not stop it.
What stops it is removing the browser permission, extension or program that opens the page. If you see the same page on every device in the house without visiting the same sites, that is unusual and worth checking the router's DNS settings, but it is not what has been reported here.
Which browser settings protect against fake alerts?
Three matter most. First, notifications: set your browser to ask before allowing them, and block sites you do not trust. Second, reputation checks: SmartScreen in Edge and Safe Browsing in Chrome warn you before known scam pages load, and Firefox has its own deceptive-content protection under Privacy & Security.
Third, pop-ups and redirects: keep the default blocking on. Add a reputable ad blocker if fake alerts keep reaching you through ads on sites you use. Review the notification list every few months.
Will Fortect remove Captcha-smart.top?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Captcha-smart.top, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Pay-per-click (read October 6, 2026)
- TrendMicro: What Are the Different Types of Phishing? (read October 6, 2026)
- BusinessInsider: What you can do with an IP address, and how to protect yours from hackers (read October 6, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)