Don’t Let Captcha Scams Catch You!

CAPTCHA is a security feature used on websites to confirm that the user is a real human and not an automated program (bot). But threat actors are leveraging it for malicious purposes. Fake CAPTCHA pages appear to be one of the fastest-growing social engineering scams lately.

What is a CAPTCHA scam?

A CAPTCHA scam is a malicious webpage that imitates legitimate verification tools like Google reCAPTCHA or Cloudflare checks. Instead of confirming you are human, it tries to trick you into performing harmful actions such as downloading malware, entering sensitive data, or executing commands on your device.

How CAPTCHA scam works

• You land on a compromised or shady website
• A familiar box asking you to prove you are not a robot appears
• After clicking it, you are asked to do something unusual, such as, paste and enter text into your system (e.g., via Windows Run), download a “verification file” or allow browser notifications

In most cases, victims are tricked into running malicious PowerShell commands that install password-stealing malware. Because the interface looks legitimate, many users comply without hesitation. A common variant, sometimes called ClickFix, shows a CAPTCHA followed by instructions like:

Press Windows + R → Ctrl + V → Enter. This executes hidden malicious code on your system.

Common types of sites where fake CAPTCHAs appear

• Compromised WordPress sites — Attackers inject fake Cloudflare-style CAPTCHA pages into legitimate but hacked websites, making them appear trustworthy
• Typo-squatted domains — Website addresses that look almost like real sites (e.g., slight misspellings) often host fake CAPTCHA pop-ups to lure users
• Malicious ad landing pages — Clicking suspicious ads can redirect you to pages with fake verification prompts designed to install malware
• Pirated content and download sites — These frequently display fake CAPTCHAs asking users to “verify” before accessing files

Red flags you should watch out for

• Asking you to run commands or paste text
• Prompting downloads or installations
• Appearing on unknown or suspicious websites
• Requesting permissions (like notifications) unrelated to verification

How you can stay safe

• Avoid interacting with CAPTCHAs on unfamiliar websites
• Check website addresses carefully
• Close the page immediately if instructions seem unusual
• Keep your web browsers and security software up-to-date

The next time you see a CAPTCHA, do not rush to click. Ensure you do your due diligence first.