This exact technique has been around for a while; there are even government resources warning about it (e.g. https://www.michigan.gov/msp/divisions/intel-ops/cyber/mc3/c... - April 2025).

As you might imagine, these attacks are aimed at less sophisticated users who may have no idea what Win+R even does, and who might be tricked into believing that this actually has anything to do with website verification.

The site you visited -- or one of the resources it depends on -- might have been compromised. If you're enterprising, you could probably determine where the malicious script is getting loaded from by looking in the page source.