Freecaptcha.top: what it is and how to remove it
Freecaptcha.top may seem like a captcha verification step but in reality, it is a bogus website created by crooks to monetize user activity. It asks people to press the "Allow" button to confirm that they are robots but actually people subscribe to push notifications.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Not sure whether the freecaptcha[.]top command did anything? An automatic scan looks through the places it would hide.
Do it yourself · free Remove Freecaptcha.top yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Freecaptcha.top: summary
| Distribution | Shady websites, deceptive ads, freeware installations |
|---|---|
| NAME | Freecaptcha.top |
| TYPE | Push notification spam; adware |
| SYMPTOMS | Pop-up ads start appearing in the corner of the screen |
| DANGERS | The ads can contain links leading to dangerous websites where users could get tricked into providing their personal information or downloading PUPs and malware |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | Freecaptcha.top |
| Type | Fake CAPTCHA page |
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 5 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | freecaptcha[.]top |
| First seen | 6 June 2022 |
| Facts checked | 7 October 2026 |
Is the Freecaptcha.top check real?
- Address:
freecaptcha[.]top
From our report of Jun 2022 · not reviewed since
More from our earlier report on Freecaptcha.top
- Go to your browser settings to disable notifications
- Use a maintenance tool to get rid of any remaining damage and clear your browsers
What the Freecaptcha.top scammers want
From our report of Jun 2022 · not reviewed since
Freecaptcha.top is a money generator for crooks who know how to use social engineering
Freecaptcha.top may seem like a captcha verification step but in reality, it is a bogus website created by crooks to monetize user activity.
It asks people to press the "Allow" button to confirm that they are robots but actually people subscribe to push notifications. The page uses social engineering tactics to fool users.
They start getting spammed with annoying pop-up ads that can appear even when the browser is closed. Unfortunately, they might be displayed by rogue advertising networks that place ads leading to dangerous websites. People can end up on scam pages that promote fake antivirus programs, software deals, giveaways, and surveys.
This can lead to personal information disclosure to cybercriminals, PUP (potentially unwanted program), and malware installations. Although push notification spam is not considered to be a virus, it can lead to serious problems if users are not cautious.
From our report of Jun 2022 · not reviewed since
Software bundling
Sometimes, push notification spam pages can appear without any user input.
This can happen if you have an adware infection. Adware is advertising-supported software that generates revenue from pay-per-click advertising. It can display pop-ups, banners, and cause redirects.
Most of the time, users infect themselves with adware when using freeware distribution platforms. They include additional programs in the installers to make a profit. The bundled software is not always safe and can cause quite a lot of problems. You should always be careful during the installation process or use only official web stores and developer websites whenever you want to download software.
The most important part is to check the file list and untick the boxes next to any unrelated apps in the list to prevent them from installing.
Why Freecaptcha.top opens in your browser
From our report of Jun 2022 · not reviewed since
People rarely find pages like Freecaptcha.top in the search results.
Usually, they hide in other shady sites that are unregulated. For example, illegal streaming platforms are full of deceptive ads and sneaky redirects that can take people to dangerous pages.
You should avoid clicking on random links and buttons. Only visit sites that you know are safe. Use legitimate streaming services instead of illegal streaming platforms because they are breeding grounds for all kinds of malware. Beware of fake "Download" and "Play" buttons on torrent sites and peer-to-peer file-sharing platforms.
What to do if you ran the Freecaptcha.top command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Freecaptcha.top gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Freecaptcha.top that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Freecaptcha.top can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Freecaptcha.top add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of Jun 2022 · not reviewed since
Remove browser pop-ups
To get rid of intrusive pop-up ads, you have to go to your browser settings and block the permission manually.
The process is quite simple, as we show below:
Google Chrome (desktop):
Google Chrome (Android):
MS Edge (Chromium):
- Open Google Chrome browser and go to Menu > Settings.
- Locate the Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
- Open Mozilla Firefox and go to Menu > Options.
- Click on Privacy & Security section.
- Under Permissions, you should be able to see Notifications. Click Settings button next to it.
- In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
- Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
- Click on Safari > Preferences...
- Go to Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
- Open Microsoft Edge, and go to Settings.
- Select Site permissions.
- Go to Notifications on the right.
- Under Allow, you will find the unwanted entry.
- Click on More actions and select Block.
From our report of Jun 2022 · not reviewed since
Get rid of cookies and cache
It would be best to avoid shady pages that engage in illegal activities.
They can use cookies to track your IP address and geolocation. Websites also have the ability to collect data about your browsing behavior like the websites you visit, searches you make, what you purchase online, etc.
Cookies and cache are small data files stored in your system so they can slow down your device. You can do it automatically with . This will delete the information websites have collected about you and will improve system performance.
From our report of Jun 2022 · not reviewed since
Scan your system with anti-malware tools
If the previous removal method did not work, this will most likely fix it.
You have to eliminate the app that is causing the erratic behavior in the background from your system. Using or professional security tools would make the process much easier for you as they can automatically remove intruders by scanning your system. Doing it manually does not work for everyone, as it is unclear which application is at fault.
However, if you still want to do this yourself, here are the step-by-step instructions:
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till uninstallation process is complete and click OK.
- Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
- Pick the unwanted application by clicking on it once.
- At the top, click Uninstall/Change.
- In the confirmation prompt, pick Yes.
- Click OK once the removal process is finished.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
Questions about Freecaptcha.top
What did the freecaptcha[.]top verification command do?
In ClickFix campaigns the pasted line starts a hidden PowerShell, mshta or curl process that fetches a script from a remote server and runs it. That script installs the real payload, most often an information stealer, sometimes a remote access tool or a loader that brings more malware later.
The exact payload of freecaptcha[.]top can change from day to day, which is why the safe response does not depend on knowing it: scan offline, remove what was added and change passwords from another device. Look in the Run box history with Win+R to confirm the command was executed.
Was freecaptcha[.]top hacked, or is it a scam site?
Both happen. Many ClickFix pages are injected into legitimate websites whose software was not updated, so a site you know can suddenly show a fake check. Others sit on throwaway domains reached through ads or links in messages.
For you the answer is the same: do not follow the instructions on freecaptcha[.]top, and if you already did, clean the PC and change passwords. If the site belongs to a business you trust, let them know through a contact form; they may not realise their pages have been tampered with.
Does a human-verification check know about Freecaptcha.top?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening freecaptcha[.]top?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Freecaptcha.top use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
Can Freecaptcha.top harm my PC just by being open?
No. A web page runs inside the browser's sandbox and cannot install programs, read your files or change Windows settings on its own. Freecaptcha.top can only make noise, fill the screen and try to persuade you. The risk begins when you follow it:
- calling the number
- paying
- downloading a file
- pasting a command
Close the page, and if it frightened you into doing one of those, follow the matching steps in this guide. Otherwise, nothing on the PC needs cleaning or repairing.
Why is pasting a command so dangerous?
Because it skips every protection that would stop a normal download. Browsers check files you download and SmartScreen checks programs you open, but a command you type yourself is trusted as your own action. Pages like Freecaptcha.top exploit exactly this.
The command fetches and runs code in memory, often leaving little on the disk for a quick scan to find. That is why the advice is absolute: no website has a legitimate reason to make you paste anything into Run, Terminal or PowerShell.
The page will not close. What can I do?
Press Esc to leave full-screen mode, then close the tab. If the browser is frozen, open Task Manager with Ctrl + Shift + Esc, select the browser and click End task. When you restart the browser, do not restore tabs.
If the page loads again on start, open a new window and close the old one, then remove the page from the browser's startup settings. Restarting the PC also works. Nothing was installed by the page, so closing it by force is safe and loses nothing.
I closed it, but it appeared again the next day. Why?
A page that returns on its own has a trigger. Look at how it appeared: from a pop-up in the corner of the screen means a notification permission; on start-up means a session restore or a changed start page; while browsing any site means an extension; on one particular site means that site's ads.
Each has a quick fix in the browser settings. If none of them explains it, reset the browser, which clears permissions, extensions and start pages together.
Will Fortect remove Freecaptcha.top?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Freecaptcha.top, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Howtogeek: PUPs Explained: What is a "Potentially Unwanted Program"? (read October 7, 2026)
- Torrentfreak: Google Targets Fake 'Download' and 'Play' Buttons (read October 7, 2026)
- Malwarebytes: Adware (read October 7, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)