This one looks real:

It might be the case, but not necessarily. There are quite a few backdoors (of either the browser or the OS) allowing the attacker running unauthorized code on the victim's machine.