Microsoft said fake CAPTCHA pages asking users to press Windows+R, Ctrl+V and Enter ran hidden commands on over 1.1 million devices between February and early May. The keystrokes paste and run a command the page had copied to the clipboard, usually installing password-stealing malware. The US FTC said real CAPTCHAs never ask users to run commands.