Fake CAPTCHAs: when clicking to “prove you’re human” installs malware

On the Internet, CAPTCHAs have become a familiar sight: ticking a box, selecting traffic lights, or typing distorted letters, all to prove you're not a robot. But recently, cybercriminals have hijacked this well-known mechanism to quietly slip malware onto victims' machines.

A simple attack, but a dangerously effective one

Cybersecurity researchers have identified a campaign in which fraudulent websites embed fake interactive CAPTCHAs. The scenario goes like this:

• The user lands on a site that appears to offer something appealing (a free movie, a document, a tool, etc.).
• Before accessing the content, a page appears with a CAPTCHA reading "Check here if you're not a robot."
• The user clicks the box, thinking it's a standard security step.

But in reality, that click triggers a script that automatically copies a command to the user's clipboard.

The next step: the trap

After clicking, a message appears on screen, often phrased as a system instruction: "If the page doesn't load, press Win + R and paste this command."

The copied command is actually a disguised PowerShell script (for example, with a fake .jpg or .mp3 extension) which, once executed, downloads and installs malicious software on the computer.

The associated risks

These scripts can install various types of malware, including:

• stealers, capable of harvesting your login credentials, passwords, and session cookies,
• RATs (Remote Access Trojans), which let an attacker take remote control of your machine.

And all of this... while the user simply thinks they're "completing a CAPTCHA."

How to protect yourself

1. Never follow system instructions displayed by a website

A legitimate website will never ask you to open Windows' "Run" menu or paste a system command. If a site does: close it immediately.

2. Avoid sites with questionable content

Free movies, online generators, "cracked" versions... these sites are often malware traps in disguise.

3. Use an antivirus capable of blocking scripts

Modern security solutions can detect the automatic execution of scripts or suspicious exploitation of the clipboard.

4. Keep an eye on what's copied to your clipboard

Some browsers or extensions can warn you when a site tries to access it. Enable these options if available.

In summary

This attack works because it relies on a familiar element: the CAPTCHA. And because it turns a single click into code execution, without the user ever realizing it.

Vigilance remains the best defense. Even when facing things we assume are harmless, like a simple checkbox.