Captchatest.top: what it is and how to remove it
Captchatest.top is a deceptive site that uses social engineering tactics to trick people into subscribing to push notifications. It asks users to press the "Allow" button to confirm that they are not robots.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If you ran the command from captchatest[.]top, a free scan can check startup items, tasks and programs that loaders usually add.
Do it yourself · free Remove Captchatest.top yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Captchatest.top: summary
| Distribution | Shady websites, deceptive ads, freeware installations |
|---|---|
| NAME | Captchatest.top |
| TYPE | Push notification spam; adware |
| SYMPTOMS | Pop-up ads start appearing in the corner of the screen sometimes even when the browsing is not in-use |
| DANGERS | Pop-ups can contain links leading to dangerous websites where users could get tricked into providing their personal information or downloading PUPs and malware |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | Captchatest.top |
| Type | Fake CAPTCHA page |
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 4 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | captchatest[.]top |
| First seen | 6 June 2022 |
| Facts checked | 7 October 2026 |
What the Captchatest.top pop-up looks like
Type Allow to verify that you are not a robot
Click Allow to watch the video
Download is ready. Click Allow to download your file
Press Allow to verify that you are not a robot
Is the Captchatest.top check real?
- Address:
captchatest[.]top
From our report of Jun 2022 · not reviewed since
More from our earlier report on Captchatest.top
- Go to your browser settings to disable notifications; scanning your system with anti-malware tools is recommended
What the Captchatest.top scammers want
From our report of Jun 2022 · not reviewed since
Captchatest.top uses social engineering to make people subscribe to push notifications
Captchatest.top is a deceptive site that uses social engineering tactics to trick people into subscribing to push notifications.
It asks users to press the "Allow" button to confirm that they are not robots. However, the button gives permission for the page to start spamming people with annoying pop-up ads.
The creators of the site may also use rogue advertising networks that place ads leading to dangerous websites. People may end up on scam sites that try to trick them into providing personal information, downloading PUPs (potentially unwanted programs), and even malware.
From our report of Jun 2022 · not reviewed since
Social engineering
Social engineering methods help crooks manipulate people into performing an action they want.
Nowadays, they do not need to have any hacking skills to monetize user activity. All they have to do is come up with a convincing message and image. You may come across messages like this:
This can remind people of a captcha verification process. However, a legitimate human verification step would never ask you to choose between "Block" and "Allow" on a browser prompt. If a page actually wants to confirm that you are not a robot, it would ask you to identify certain objects in pictures, like traffic lights and bicycles or to simply check a box.
From our report of Jun 2022 · not reviewed since
Disable the intrusive pop-ups
Push notifications are based on a subscription model, so users can enable and disable them manually in the browser settings.
If you need help with the process, follow the guide below:
Google Chrome (desktop):
Google Chrome (Android):
MS Edge (Chromium):
- Open Google Chrome browser and go to Menu > Settings.
- Locate Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
- Open Mozilla Firefox and go to Menu > Options.
- Click on Privacy & Security section.
- Under Permissions, you should be able to see Notifications. Click the Settings button next to it.
- In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
- Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
- Click on Safari > Preferences...
- Go to the Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
- Open Microsoft Edge, and go to Settings.
- Select Site permissions.
- Go to Notifications on the right.
- Under Allow, you will find the unwanted entry.
- Click on More actions and select Block.
From our report of Jun 2022 · not reviewed since
Protect your browsing privacy
All of the pages that you visit use cookies to track your browsing activities.
Generally, this is not a bad thing as it helps websites personalize the user experience, but in some cases, it can cause many issues. If the pages you visit do not have strong security, cookies can be hijacked and used for malicious purposes. Untrustworthy pages can also sell them to advertising networks and other third parties.
That is why it is important to clear your browsers regularly. This can be automated with a maintenance tool like . It can delete all cookies and cache and also fix system damage, errors, registry issues which is especially helpful after a virus infection.
From our report of Jun 2022 · not reviewed since
Scan the system for adware
Once you block the notifications, there is still a chance that there is adware hiding in your system.
It is a type of PUP that can generate commercial content in the machine without your knowledge or consent.
They can detect suspicious processes running in your machine and eliminate all the files causing it. What is more, it can prevent such infections in the future by warning you about a dangerous download.
Of course, you can remove programs manually, but it can be difficult to identify PUPs as they can be disguised as "handy" tools that you use every day. If you want to perform manual removal, you can follow the instructions posted below for Windows and Mac systems:
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till uninstallation process is complete and click OK.
- Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
- Pick the unwanted application by clicking on it once.
- At the top, click Uninstall/Change.
- In the confirmation prompt, pick Yes.
- Click OK once the removal process is finished.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
Why Captchatest.top opens in your browser
From our report of Jun 2022 · not reviewed since
Sites like Captchatest.top, are rarely found in the search results.
Most of the time, they hide in other shady pages which are unregulated. If you visit illegal streaming platforms, you may have noticed that they are full of deceptive ads and sneaky redirects. Fake "Download" and "Play" buttons usually open harmful websites.
It is important to be careful while browsing the web. Visit sites that you know and trust. Use legitimate streaming platforms instead of rogue movie websites.
They require only a small monthly subscription fee. If a new tab opens unexpectedly, it is best not to interact with it and close it.
In some cases, push notification spam websites can open without any user input. This can happen if you are infected by adware. It can cause an increased amount of commercial content, like pop-ups, banners, and redirects. It can operate in the background of the system without the users' knowledge.
What to do if you ran the Captchatest.top command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Captchatest.top gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Captchatest.top that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Captchatest.top can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Captchatest.top add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
Questions about Captchatest.top
I pressed Win+R and pasted the code from captchatest[.]top. Am I hacked?
Assume yes and act now. The command a fake CAPTCHA on captchatest[.]top copies to your clipboard downloads and runs malware, usually an information stealer or a remote access trojan, and stealers can copy browser passwords and cookies within a minute. Disconnect the PC from the internet.
Run a Microsoft Defender Offline scan, then remove new startup items, scheduled tasks and programs. From another device, change your e-mail password first, then banking and everything else saved in the browser, sign out of all sessions and turn on two-step verification. If crypto wallets were on the PC, move the funds from a clean device.
Was captchatest[.]top hacked, or is it a scam site?
Both happen. Many ClickFix pages are injected into legitimate websites whose software was not updated, so a site you know can suddenly show a fake check. Others sit on throwaway domains reached through ads or links in messages.
For you the answer is the same: do not follow the instructions on captchatest[.]top, and if you already did, clean the PC and change passwords. If the site belongs to a business you trust, let them know through a contact form; they may not realise their pages have been tampered with.
Does a human-verification check know about Captchatest.top?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening captchatest[.]top?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Captchatest.top use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
Which browser settings protect against fake alerts?
Three matter most. First, notifications: set your browser to ask before allowing them, and block sites you do not trust. Second, reputation checks: SmartScreen in Edge and Safe Browsing in Chrome warn you before known scam pages load, and Firefox has its own deceptive-content protection under Privacy & Security.
Third, pop-ups and redirects: keep the default blocking on. Add a reputable ad blocker if fake alerts keep reaching you through ads on sites you use. Review the notification list every few months.
Can Captchatest.top harm my PC just by being open?
No. A web page runs inside the browser's sandbox and cannot install programs, read your files or change Windows settings on its own. Captchatest.top can only make noise, fill the screen and try to persuade you. The risk begins when you follow it:
- calling the number
- paying
- downloading a file
- pasting a command
Close the page, and if it frightened you into doing one of those, follow the matching steps in this guide. Otherwise, nothing on the PC needs cleaning or repairing.
The page will not close. What can I do?
Press Esc to leave full-screen mode, then close the tab. If the browser is frozen, open Task Manager with Ctrl + Shift + Esc, select the browser and click End task. When you restart the browser, do not restore tabs.
If the page loads again on start, open a new window and close the old one, then remove the page from the browser's startup settings. Restarting the PC also works. Nothing was installed by the page, so closing it by force is safe and loses nothing.
Is my phone affected by Captchatest.top?
Not through the PC. A scam page in a Windows browser cannot reach a phone, even if both use the same account. The sign reported, A fake CAPTCHA on captchatest[.]top that asks you to paste a command, happened in a browser on the PC.
Phones can meet similar pages on their own, usually through ads or notifications, and the fix there is the same idea: remove notification permissions and unknown apps. If you used the phone to call a number shown on the page, follow the steps for callers in this guide.
Will Fortect remove Captchatest.top?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Captchatest.top, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Howtogeek: PUPs Explained: What is a "Potentially Unwanted Program"? (read October 7, 2026)
- Stormshield: Illegal streaming: beware of the backlash (read October 7, 2026)
- Dataprot: What Are Cookies? The Good and the Bad of Browser Cookies (read October 7, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)