A dentist’s site wants me to paste a command into PowerShell. What should I do?

Do not paste or run it. A human check should never ask you to open a command window or execute copied instructions. This is a known style of social-engineering attack, sometimes called ClickFix.

It strongly suggests something on the page or the route to it is malicious, but it does not prove the dentist’s own website was hacked. An ad, redirect, or lookalike domain could also be involved.

Close the page and let the dentist’s office know what happened. Send them the exact page address you visited, along with roughly when you saw the prompt and what it asked you to do. Don’t send the command itself by pasting it into a terminal or testing it.

If you only saw the page and did not run anything, that is a different situation from executing the command. If you did run it, stop using that device for sensitive accounts and get help from a trusted IT or security professional.

Check the address carefully before assuming it was the real clinic site. A convincing-looking address can belong to someone else, and a legitimate site can also show harmful content through a compromised page or third-party material.

Either way, treat the prompt as malicious. Don’t try to decode or test the command on your everyday computer. If you already executed it, use a separate, trusted device to contact support and consider changing important passwords from that clean device.