The scam exploits a routine that millions of people encounter when browsing websites. Instead of asking visitors to identify objects in pictures or enter distorted characters, fake CAPTCHA pages instruct them to use keyboard shortcuts, open system tools or paste commands into their devices.
These actions can trigger the installation of malicious software designed to collect passwords, browser data and other sensitive information.
How the fake verification works
CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.” These tests help websites distinguish human visitors from automated bots, which can be used for spam, fake account creation and other malicious activities.
Scammers exploit the fact that people are accustomed to completing these checks without questioning them. They create fake verification pages that imitate legitimate websites or copy the appearance of familiar CAPTCHA systems.
According to Fast Company, some fraudulent pages instruct Windows users to press the Windows and R keys, followed by Ctrl and V. On Mac computers, victims may be told to open Terminal, Apple’s command-line application, and paste text into it.
The instructions may appear to be part of an additional security check. In reality, the website has already copied a malicious command to the user’s clipboard. Pasting and executing it can trigger the download and installation of malware.
Malwarebytes describes a similar technique in which fake CAPTCHA pages use the Windows Run dialog to launch commands that install information-stealing software. Some pages even include video tutorials showing victims how to follow the instructions.
Read also : French supermarkets suffer refrigerator shutdown after ‘unprecedented’ cyberattack
What can the malware steal?
The consequences can go well beyond an infected computer. Some of the malicious programs distributed through these scams are designed to collect saved passwords, browser cookies and login credentials, potentially giving attackers access to personal accounts and financial information.
Malwarebytes identifies information stealers such as Lumma Stealer among the threats associated with fake CAPTCHA campaigns. Other attacks can install Remote Access Trojans, including AsyncRAT, SecTopRAT and XWorm, which may allow criminals to access files or maintain a hidden connection to an infected device.
Some campaigns also use techniques designed to make detection more difficult, including hiding malicious instructions in PowerShell commands or running harmful code directly in a computer’s memory.
How to recognize a fake CAPTCHA
A key warning sign is any verification page that asks users to do more than complete a normal visual or audio test.
Legitimate CAPTCHA checks do not require visitors to open Terminal, launch the Windows Run dialog, paste commands or download files to prove they are human.
Users should also pay attention to the website address. Fraudulent pages may imitate well-known brands while using slightly altered or unfamiliar domains. Unexpected CAPTCHA pop-ups, particularly on websites that do not match the service they claim to represent, are another reason to be cautious.
What to do if you encounter one
Fast Company advises users not to interact with suspicious verification pages. Anyone who has followed the instructions, particularly if a file was downloaded or a command executed, should disconnect the affected device from the internet and run updated security software.
Read also : Governments are urging people to stock up on food and water. What is behind the warnings?
Malwarebytes also recommends deleting suspicious downloads without opening them, checking the browser for unfamiliar extensions and changing important passwords from a separate, secure device after the system has been checked. Users should monitor their accounts for unusual activity in the following weeks.
Keeping operating systems, browsers and security software updated can also help reduce exposure to malicious websites and downloads.
The main precaution is simple: a CAPTCHA should never ask you to run a command on your computer. If a supposed human verification test tells you to open a system tool or paste text into it, close the page instead.
