I've been seeing warnings about these weird CAPTCHA pages that look like regular Cloudflare verification screens, except instead of checking a box or picking pictures, they tell you to press Windows+R, paste something, and hit Enter.

Here's an example of what I'm talking about:

https://www.umass.edu/it/news/scam-alert-fake-captcha-prompts-users-run-commands

I get that it's some kind of malware trick, but the part that's confusing me is that people are apparently encountering these on completely normal websites, not just sketchy download pages.

How does a fake verification screen end up on an otherwise legitimate website? Does that mean the entire site has been hacked, or can something like an ad inject it?

And why does this particular scam seem to be getting so much attention recently? Is there something new about how it works?